> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Active exploitation of Drupal Commerce Core authorization bypass CVE-2026-118539 - URL: https://f4n6.co.uk/security-feed/active-exploitation-of-drupal-commerce-core-authorization-bypass-cve-2026-118539/ - Published: 2026-10-30T09:46:10.000Z - Updated: 2026-10-30T09:46:10.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-118539 ## 1\. Executive summary Drupal has warned that threat actors are actively exploiting CVE-2026-118539, a missing authorization flaw in the Commerce Core module affecting versions 0.0.0 through 2.41 and 3.0.0 through 3.3.13\. Commerce Core provides the shopping cart and checkout functions on Drupal sites, so any EMEA financial services client running an internet-facing Drupal storefront on an affected version is exposed. No CVSS score has been published and the CVE is not in CISA KEV, so the exploitation claim rests on Drupal's own warning as relayed by The Hacker News; the source does not describe the exploitation mechanics. The bottom-line risk is to client-facing commerce and payment flows on Drupal, where a missing authorization check can expose order, customer or transaction functions to unauthenticated or under-privileged users. ## 2\. Regulatory framing No specific DORA/NIS2 article is directly engaged by this item. ## 3\. Technical analysis & attack chain The source confirms active exploitation but does not describe the attack chain. The following is what is established, with the gaps stated. 1. Drupal published an advisory for CVE-2026-118539 in the Commerce Core component, classified as missing authorization (CWE-862). 2. Affected versions are Commerce Core 0.0.0 to 2.41 and 3.0.0 to 3.3.13. 3. Drupal states the flaw is being actively exploited. The source does not say which endpoints, request patterns or post-exploitation actions are involved. The vulnerability class is missing authorization: a code path that should enforce a permission check does not, so a request that should be rejected is processed. In a commerce module the functions that sit behind authorization checks are order management, cart and checkout operations, customer and order data access, and administrative commerce configuration. The source does not identify which of these is affected, so the specific reachable function cannot be stated from the material available. Treat the exposure as the full Commerce Core surface until Drupal's advisory names the affected route. No payload, malware capability, persistence mechanism, command-and-control channel, lateral movement or exfiltration detail is given in the source. No exploitation tooling, request sample or proof-of-concept is described. No actor is named and no attribution is offered. Confidence caveat: the active-exploitation claim is single-sourced to Drupal's warning as reported by The Hacker News. The related sources in this package concern unrelated commerce platforms (SAP Commerce Cloud CVE-2026-58231, Adobe Commerce and Magento CVE-2026-71362, Oracle Commerce) and Drupal Core CVE-2026-9082; none corroborate the Commerce Core exploitation. Verify against Drupal's security advisory before acting on the exploitation claim beyond patching. Discrepancy note: the source headline calls the flaw "highly critical" while the verified record carries no CVSS score. The severity label is Drupal's own wording, not a scored rating; no CVSS value should be assumed. ## 4\. Mitigation & containment P1 (within 24h) - Identify every Drupal instance running Commerce Core and record its version. Any instance in 0.0.0 to 2.41 or 3.0.0 to 3.3.13 is in scope. - Apply the Commerce Core update Drupal issued for CVE-2026-118539\. The source does not state the fixed version numbers; take them from Drupal's advisory for the CVE rather than assuming the next point release. - Where an update cannot be applied immediately, remove external reachability of the affected commerce functions (place the storefront behind authentication or an access-restricted reverse proxy) until the patch is in place. P2 (within 72h) - Review web server and Drupal logs for requests to Commerce Core routes from unauthenticated or low-privilege sessions that returned success, focusing on order, cart, checkout and commerce admin paths. The source gives no request signature, so baseline against normal traffic rather than a fixed pattern. - Audit commerce data for unauthorized order creation, modification or access that does not match a legitimate customer session. P3 (within 7 days) - Add Commerce Core version to the asset inventory and patch-tracking process so future advisories are matched against deployed versions automatically. - Confirm Drupal core and contributed-module update subscriptions are current for all commerce sites. ## 5\. Indicators of compromise No indicators of compromise available in the source material. The source describes no atomic indicators. The only observable behaviour it supports is the exploitation of Commerce Core authorization checks, which is not specific enough to pivot on without Drupal's advisory detail. ## 6\. Detection Insufficient indicators to author detection rules. ## CVE assessment 1 referenced CVE | CVE | CVSS | Exploited | EPSS | Summary | | ---------------------------------------------------------------------------------- | ---- | --------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-118539](https://nvd.nist.gov/vuln/detail/CVE-2026-118539?ref=f4n6.co.uk) | — | — | — | Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions… | ## 7\. Sources - The Hacker News, "Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw", https://thehackernews.com/2026/10/hackers-actively-exploit-highly.html, 2026-10-30. - The Hacker News, "SAP Commerce Cloud CVE-2026-58231 Targeted in Exploitation Attempts Days After Patch", https://thehackernews.com/2026/08/sap-commerce-cloud-cve-2026-58231.html (related context, unrelated platform). - NVD, "CVE-2026-71362 Adobe Commerce and Magento Incorrect Authorization Vulnerability" (CISA KEV entry), https://nvd.nist.gov/vuln/detail/CVE-2026-71362 (related context, unrelated platform). - The Hacker News, "SAP Commerce Cloud Flaw Could Let Unauthenticated Attackers Execute Arbitrary Code", https://thehackernews.com/2026/08/sap-commerce-cloud-flaw-could-let.html (related context, unrelated platform). - GitHub Security Advisories, "Adobe Commerce Incorrect Authorization", https://github.com/advisories/GHSA-5g6h-388x-r7r7 (related context, unrelated platform). - The Hacker News, "Drupal Core SQL Injection Bug Actively Exploited, Added to CISA KEV", https://thehackernews.com/2026/05/drupal-core-sql-injection-bug-actively.html (related context, different CVE). - GitHub Security Advisories, "Oracle Commerce Guided Search / Experience Manager", https://github.com/advisories/GHSA-fh33-cgjq-wrq9 (related context, unrelated platform). ## 8\. Adverse Trace position Adverse Trace assesses CVE-2026-118539 as a missing authorization flaw in Drupal Commerce Core with active exploitation reported by Drupal, but with no CVSS score and no CISA KEV listing, and with the exploitation claim single-sourced; clients running affected Commerce Core versions on internet-facing storefronts should treat patching as urgent regardless. The client impact is concentrated on commerce and payment-facing Drupal sites, where the source does not let us bound what an unauthorized request can reach. We will obtain Drupal's advisory for the fixed version numbers and affected routes, re-check CISA KEV and EPSS for this CVE, and update this note when the exploitation mechanics or a scored severity is available. --- [Read the original source →](https://thehackernews.com/2026/10/hackers-actively-exploit-highly.html?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*