Drupal has issued a warning about a 'highly critical' security flaw in its Commerce Core component, which is currently being exploited by threat actors. The vulnerability, identified as CVE-2026-118539, affects Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13.
The flaw involves missing authorization, allowing unauthenticated attackers to potentially make unauthorized changes to store data and transactions. This could have significant financial implications for vendors using the affected versions.
Drupal has confirmed that the vulnerability is being actively exploited in the wild. The organization has not disclosed specific details about the attacks or the extent of the exploitation.
To mitigate the risk, Drupal recommends users upgrade to Commerce Core 3.3.13 or Commerce Core 8.x-2.41. The Commerce Core module is utilized by over 42,000 websites, including many high-profile organizations.
The vulnerability was reported by researchers Dan Puccetti, Marcus Johansson, and Robert Snyder. Drupal has assigned the flaw a risk score of 21 out of 25, highlighting its critical severity.