Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw

A highly critical security vulnerability tracked as CVE-2026-118539 has been discovered in Drupal's Commerce Core component. The flaw is a missing authorization issue affecting Commerce Core versions 0.0.0 to 2.41 and 3.0.0 to 3.3.13. Threat actors are actively exploiting this vulnerability in the wild. The Commerce Core module enables e-commerce functionality including shopping cart capabilities for Drupal-based websites. Drupal has issued a warning to its user base regarding the active exploitation. The CVSS score has not yet been assigned, though the vulnerability is classified as highly critical. Site administrators are urged to apply patches or mitigations immediately to prevent unauthorized access.