Drupal Confirms Active Exploitation of Commerce Core Access-Control Flaw

Drupal has confirmed active exploitation of an access-control vulnerability in Commerce Core. Tracked as CVE-2026-118539, the flaw affects versions before 2.41 and versions from 3.0.0 to before 3.3.13. Organizations using affected releases for online stores or transaction management systems should assess their exposure. Technical facts and known limits Some Commerce Core routes and entity fields lack sufficient access protection, creating a possibility of bypassing access controls. Drupal considers the issue very serious, but the source provides no CVSS score. An access-control bypass could have financial consequences for vendors. Drupal has not disclosed exploitation methods or the scale of the activity. The available information does not establish which organizations are being targeted, how widespread exploitation is, or who is responsible. No specific indicators of compromise are provided. TMGS defensive recommendations TMGS recommends prioritizing the following actions: Inventory Drupal websites and applications using Commerce Core, and compare their installed versions with the affected ranges. Coordinate upgrades with operations teams: update the 3.x branch to 3.3.13 and older versions to 8.x-2.41. Verify the installed version after the update. Review application and system logs for unusual access or unauthorized activity involving Commerce Core routes and entity fields. If suspicious access is found, assess related transactions and data changes, document the incident, and follow internal incident-response procedures as needed. Monitor Drupal announcements for further information about affected systems and exploitation. For businesses in Vietnam using Commerce Core, TMGS recommends starting with version verification to determine whether their deployments are affected. Read the full analysis on TMGS: https://tmgs.vn/tin-tuc/drupal-canh-bao-commerce-core-bi-khai-thac-i.e2279eb0-3b0c-4ea9-8e37-0b3187cf0cb5