We need answer only headline <=90 chars, factual, no five-word sequence with external source. Need craft new headline. Need include key fact

Key points

• CVE-2026-118539 affects the Drupal Commerce Core module.
• Impacted releases span 0.0.0 through 2.41 and 3.0.0 through 3.3.13.
• The flaw permits authorization bypass and is being exploited in the wild.
• An October 2026 warning urges site owners to update and monitor for abuse.

In October 2026, Drupal warned that a security defect in its Commerce Core module, tracked as CVE-2026-118539, is being used by attackers. The issue is an authorization bypass, meaning a user may be able to reach actions or data that should remain outside their permissions. Because exploitation is already occurring, treating this as a theoretical module bug would be a mistake.

The vulnerable code appears in two release lines: every version from 0.0.0 up to and including 2.41, and the 3.0.0 through 3.3.13 range. Any Drupal site running Commerce Core in those bands should be assumed exposed until it is confirmed otherwise. The warning is especially relevant for school, district, or department sites that use the module for registrations, payments, gated resources, or other commerce-related workflows.

An authorization bypass matters because it can undermine the permission model that protects administrative functions and sensitive records. In an ecommerce context, that could mean unintended access to order data, configuration, or privileged operations. Active exploitation raises the priority: attackers do not need to develop a new technique if a working path already exists.

Administrators should first determine whether Commerce Core is present and which release is installed. Then apply the vendor's fixed update and verify that the running version falls outside the affected ranges. While patching is pending, restrict access to the module where feasible, use virtual patching or web application firewall rules if available, and review logs for unexpected privileged actions, account changes, or configuration edits. Watch the Drupal advisory and CVE-2026-118539 for updates, and treat signs of unauthorized access as an incident requiring containment.

What to do now

1. Inventory every Drupal instance and record whether Commerce Core is installed and which version is running.
2. Update Commerce Core to a vendor-supported fixed release that is outside both affected version ranges, then confirm the deployed version.
3. If immediate patching is not possible, temporarily disable the module or restrict access to its routes, and apply virtual patching or WAF rules where available.
4. Review logs for unauthorized access, new privileged accounts, changed settings, and suspicious commerce-related actions; preserve evidence if abuse is found.
5. Rotate credentials and invalidate sessions for administrative accounts if compromise is suspected, and enforce least privilege on Drupal roles.
6. Monitor the Drupal advisory and CVE-2026-118539 for revised guidance, and subscribe to vendor security notifications.

CVE references

• CVE-2026-118539

Original source

The Hacker News