The Hacker News reported on 30 October that Drupal has warned of attacks on a flaw it rates "highly critical". The flaw sits in Commerce Core, the module that adds a shopping cart and checkout to Drupal sites. It is tracked as CVE-2026-118539. Drupal says the module does not properly guard some routes and entity fields (data fields on store records). That lets an attacker skip access checks, which could cost the seller money. Drupal credited researchers Dan Puccetti, Marcus Johansson and Robert Snyder with reporting it.
Drupal said the flaw is being exploited in the wild. It gave no details on what the attackers are doing or how far the campaign reaches. The Hacker News lists no CVSS severity score for the flaw. It gives the affected versions as 0.0.0 to 2.41 and 3.0.0 to 3.3.13. Drupal advises sites on version 3 to upgrade to Commerce Core 3.3.13. Sites on earlier versions should move to 8.x-2.41.
Anyone who runs a Drupal store should check which Commerce Core version they use and apply the matching update. Drupal confirms attacks are under way, and the module handles carts, checkout and API access to store data.