Critical Access Bypass in Drupal Commerce Core (CVE‑2026‑118539) Actively Exploited
What Happened — Drupal’s security team disclosed a critical authorization bypass in the open‑source Commerce Core module (CVE‑2026‑118539). The flaw affects Commerce Core 0.0.0‑2.41 and 3.0.0‑3.3.13 and allows unauthenticated attackers to reach protected routes and entity fields, effectively bypassing access controls. Threat actors are already exploiting the defect in the wild, prompting CISA to add the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog and issue a three‑day patch mandate for federal systems. Drupal urged all site operators—over 42 000 installations, including Fortune 500 firms and research universities—to upgrade to the patched version (3.3.13 or 8.x‑2.41) and audit order data for inconsistencies.
Why It Matters for Trust & Control Assurance — The incident tests the “access‑control” control objective that underpins many frameworks; continuous evidence of patch status and authorization testing is essential.
Who Is Affected — Organizations running Drupal‑based e‑commerce sites (tech‑SaaS, retail, education, etc.).
Recommended Actions
- Apply the Commerce Core 3.3.13 (or 8.x‑2.41) update immediately.
- Conduct a post‑patch audit of order records and checkout flows for unauthorized modifications.
- Enable automated version monitoring for all Drupal modules and retain patch‑installation logs as audit evidence.
- Review your access‑control policies to ensure routes and entity fields are properly protected.
Technical Notes
- Attack vector: exploitation of a missing authorization check (vulnerability exploit).
- CVE: CVE‑2026‑118539 (critical severity).
- Affected versions: Commerce Core 0.0.0‑2.41 and 3.0.0‑3.3.13.
- Related advisories: CISA KEV listing; prior Drupal flaws (CVE‑2026‑9082, CVE‑2026‑108097, CVE‑2026‑108099).