# Drupal warns of active exploitation of Commerce Core authorization flaw

_Published Friday, October 30, 2026 at 4:18 AM EDT · Security · Latest · Tier 2 — Notable_

![Drupal warns of active exploitation of Commerce Core authorization flaw — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEitgPkf4uToEgXwcfmDEKipEveRL2l0PEz6WIegAc2uWyf5_khO7Scgu6MpWHRovED7S-4sKJb4o88JsJT8NI8zB8WCBo04Q9TrEVNJa-08EbxP_zdPkaA7wsBEPIjXbApW1StdY8JunSewAi9TNrAcMwYZjqSsVktddqQ0uIi8-rUzXq1LMMLBHBdccapz/s1700-nu-rw-lo-l85-e365/drupal-rce.jpg)

Drupal has warned that attackers are actively exploiting an authorization flaw in Commerce Core that may financially affect merchants, The Hacker News reported. Tracked as CVE-2026-118539, the vulnerability leaves certain routes and entity fields insufficiently protected, allowing attackers to bypass access restrictions.

Commerce Core supports sales through shopping carts, checkout forms and applications using APIs. Drupal recommends upgrading the 3.x branch to Commerce Core 3.3.13 and earlier versions to Commerce Core 8.x-2.41. It has not disclosed the nature of the exploitation or the extent of the campaign.

## Sources

- [The Hacker News](https://thehackernews.com/2026/10/hackers-actively-exploit-highly.html)

---
Canonical: https://techandbusiness.org/newswire/Z7Zr9K1ZJdb0Uu7asenZZ8
Published: 2026-10-30T08:18:32.744Z
Story chronology: 2026-10-30T07:45:00.000Z
Retrieved: 2026-10-30T10:41:39.708Z
Publisher: Tech & Business (techandbusiness.org)