What Happened
Drupal warned this week of active exploitation of CVE-2026-118539, a missing authorization flaw in the Commerce Core module, according to The Hacker News. The module does not sufficiently protect certain routes and entity fields. An unauthenticated attacker bypasses access controls, and Drupal notes the financial impact falls on site vendors. The advisory carries a highly critical rating.
Affected versions run from 0.0.0 through 2.41 and from 3.0.0 through 3.3.13. Sites on the 3.x branch should move to Commerce Core 3.3.13. Earlier versions should move to 8.x-2.41. Drupal has not shared details on the attacks or their scale. BleepingComputer reports more than 42,000 websites use Commerce Core.
Why This Matters for Canadian Organizations
Canadian retailers, distributors, and service providers run storefronts on Drupal Commerce. These sites hold order histories, customer accounts, and payment-adjacent records. With no attack details published, treat every order and customer record as exposed until logs prove otherwise.
A breach of security safeguards involving a real risk of significant harm triggers PIPEDA reporting duties to the Privacy Commissioner and to affected individuals. Merchants handling card data also face PCI DSS obligations. Manipulated orders hit revenue first, and customer data exposure follows. Our TechTalk section covers the steady run of web platform flaws reaching active exploitation.
What to Do
Upgrade Commerce Core today. Follow Drupal’s guidance and audit orders for inconsistencies, such as altered totals, statuses, or fields. Review web server logs for unauthenticated requests to commerce routes. Check for new administrator accounts and unexpected changes to products and pricing. If patching waits, restrict public access to commerce routes at the web application firewall. Read our news archive for related exploited flaws.
