Drupal warns of active exploitation of Commerce Core authorization flaw

Drupal has warned that attackers are actively exploiting an authorization flaw in Commerce Core that may financially affect merchants, The Hacker News reported. Tracked as CVE-2026-118539, the vulnerability leaves certain routes and entity fields insufficiently protected, allowing attackers to bypass access restrictions. Commerce Core supports sales through shopping carts, checkout forms and applications using APIs. Drupal recommends upgrading the 3.x branch to Commerce Core 3.3.13 and earlier versions to Commerce Core 8.x-2.41. It has not disclosed the nature of the exploitation or the extent of the campaign.