Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw

What happened?

Drupal has warned that threat actors are exploiting a "highly critical" security flaw in its Commerce Core component. The vulnerability, tracked as CVE-2026-118539 (CVSS score: N/A), is a case of missing authorization affecting Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13.

Key details

• Drupal warns that a highly critical authorization bypass in Commerce Core is being actively exploited by threat actors.
• The flaw stems from missing authorization that leaves certain routes and entity fields insufficiently protected.
• Researchers Dan Puccetti, Marcus Johansson, and Robert Snyder are credited with reporting the vulnerability.
• Two critical PHP vulnerabilities known as PHP2Shell are also under active exploitation according to Wiz researchers.

Summarised by SecOraLens from The Hacker News. Always read the original source before acting. How SecOraLens verifies advisories.