Drupal Commerce Core Authorization Bypass CVE-2026-118539 Under Active Exploitation

The advisory details insufficient protection on specific routes and entity fields within the Commerce Core module, which powers shopping carts, checkout forms, and decoupled API sales. Researchers Dan Puccetti, Marcus Johansson, and Robert Snyder identified the issue. Drupal issued patches to 2.41 and 3.3.13 but released no indicators of compromise or observed attack patterns despite stating exploitation is underway.

Cross-referencing with Wiz telemetry on concurrent PHP2Shell exploitation shows opportunistic actors targeting e-commerce stacks for direct financial gain rather than data theft. The absence of public PoCs for the Drupal flaw suggests either private tooling or targeted campaigns against specific merchants, consistent with prior patterns in Magento and WooCommerce authorization bypasses.

Procurement records and incident reports indicate that Drupal Commerce instances often handle payment processing without additional WAF rules or route-level ACLs. This creates a direct path from unauthenticated requests to altered transactions. Operators should prioritize patch deployment and review recent order logs for anomalies in pricing, quantities, or payment states.

Next steps include monitoring Drupal issue queues for updated IOCs and auditing decoupled API endpoints for unauthorized field access. Failure to patch within two weeks typically correlates with measurable fraud spikes in similar open-source commerce platforms.