Drupal Commerce Core authorization bypass CVE-2026-118539 actively exploited in the wild
Drupal has issued a "highly critical" advisory (published Wednesday, October 28) for CVE-2026-118539, a missing authorization flaw in Commerce Core affecting versions 0.0.0–2.41 and 3.0.0–3.3.13. The module insufficiently protects certain routes and entity fields, enabling an access bypass by unauthenticated attackers that may financially impact vendors running online stores. Drupal gave it a risk score of 21 out of 25, indicating exploitation is possible regardless of how the module is configured (securityweek.com). Drupal confirmed the flaw is actively exploited in the wild but shared no details on how it is being exploited, who is behind it, how many sites were targeted, or whether it was abused as a zero-day. Commerce Core is a community-developed module used by more than 42,000 websites, including Fortune 500 companies and research universities (bleepingcomputer.com). Separately, two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2), collectively dubbed PHP2Shell, continue to see exploitation attempts.
Entenda a falha
A vulnerabilidade
CVE-2026-118539 is a missing authorization flaw in the Drupal Commerce Core module, rated highly critical (risk score 21/25) and actively exploited. The module does not sufficiently protect certain routes and entity fields. Unauthenticated attackers can bypass access controls, according to BleepingComputer, and SecurityWeek says Drupal's score means this works however the module is configured. The impact is financial for the vendor. Affected: 0.0.0-2.41 and 3.0.0-3.3.13. Fixed: 3.3.13 (3.x) and 8.x-2.41 (earlier). Also covered: PHP CVE-2026-109618/109619 (CVSS 9.2, PHP2Shell, exploitation attempts, no versions given); Drupal SQL injection CVE-2026-9082 (PostgreSQL sites, exploited since May, in CISA KEV); and RCE CVE-2026-108097 (Field UI) and CVE-2026-108099 (Entity List), which need other modules or custom code and have no reported exploitation.
Como funciona
Commerce Core provides a shopping cart, a checkout form and decoupled API endpoints for selling on Drupal. Requests that reach certain routes and entity fields are not adequately checked for authorization, so an unauthenticated visitor gets access that should be restricted. The articles do not say which actions are exposed or what the requests look like; they only mention financial impact and advise auditing orders for inconsistencies. For PHP2Shell, Wiz says memory exhaustion alone does not complete the chain, since PHP builds, memory limits and worker behavior can block later stages. For CVE-2026-108097 and CVE-2026-108099, the vulnerable components are not exposed by themselves, and exploitation depends on other contributed modules or custom code.
Por que é vulnerável
The root cause of CVE-2026-118539 is missing authorization: the module does not enforce sufficient access checks on certain routes and entity fields. The articles do not explain why it went unnoticed or what exactly the patch changes beyond moving to the fixed versions. They give no root-cause detail for the PHP flaws either. For CVE-2026-9082 they only identify SQL injection in the database abstraction API.
Como foi descoberta
Drupal credited researchers Dan Puccetti (dpuccetti), Marcus Johansson (marcus_johansson) and Robert Snyder (rsnyd) with reporting the Commerce Core flaw. It became public through a Drupal advisory published Wednesday, October 28, tagged highly critical, which states it is actively exploited in the wild. Drupal has not said how it is exploited, by whom, against how many sites, or whether it was a zero-day before patches. For PHP2Shell, Wiz researchers Yaara Shriki, Shahar Dorfman, Alma Blachsan and Yaron Samuel report observed exploitation; as of October 25, 52.1% of organizations were significantly affected, a declining share.
PoC pública
No public PoC is mentioned for CVE-2026-118539, but exploitation is confirmed, so patching is urgent. SecurityWeek says Drupal's ratings indicate public PoCs for two information disclosure bugs, one in Commerce Core and one in Media Alias Display (no CVEs given), and that exploit code exists for a moderately critical CAPTCHA bug (form resubmission without a new challenge). For PHP2Shell, Wiz says some attempts match public PoC exploit mechanics, but the articles give no link, author or maturity details. Wiz notes that turning those PoCs into reliable tooling is hard for opportunistic attackers.
Explicação gerada por IA a partir da matéria e dos artigos, em 30/10/2026 10:17.
2 exploits públicos
Há código de exploração publicado no Exploit-DB para CVE-2026-109618, CVE-2026-9082. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.
-
PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE
This script attacks PHP running under Apache mod_php (prefork) by sending crafted multipart uploads to any PHP page, abusing session upload-progress handling to corrupt memory. It needs only network access and no login, but the target must have specific settings: upload progress enabled, non-strict sessions, a low memory limit and a single worker. It leaks memory addresses via session cookies, then makes PHP run a short system command (14 bytes max). It looks like a working but fragile exploit, tuned to PHP 8.4.26 builds; the claim of all versions after 5.4 is unproven.
-
Drupal Core 10.5.5 - Error-Based SQL Injection
This script targets Drupal Core 10.5.5 running on PostgreSQL, abusing the JSON:API module's filter handling, where user-supplied array keys end up inside the SQL query. An unauthenticated remote attacker who can reach a site with JSON:API exposed could trigger database errors that leak data, such as the database version, in the error message. It is a short proof of concept that only demonstrates information disclosure through error-based injection, with no further exploitation. It was tested only in a local Docker setup and is not verified by Exploit-DB, but it appears to match the listed CVE.
Detalhes técnicos
The Commerce Core issue stems from inadequate route and entity field protection, allowing unauthorized access to commerce functionality (shopping cart, checkout, and decoupled API endpoints). The same October 28 release included 38 other advisories covering 21 contributed projects, nearly a dozen rated critical, including bugs leading to remote code execution, account takeover, and Commerce orders via Stripe being marked as paid without payment. The CAPTCHA module was fixed for a moderately critical flaw allowing resubmission of a protected form without solving a new challenge, with Drupal's rating indicating exploit code exists in the wild. Drupal's ratings also indicate public proofs of concept for two information disclosure bugs, one in Commerce Core and one in Media Alias Display (securityweek.com). Drupal has faced several other exploited issues in 2026: in May it warned of SQL injection CVE-2026-9082 in the database abstraction API (affecting PostgreSQL-backed sites; privilege escalation, information disclosure, RCE), which CISA added to the KEV catalog with a three-day federal patching deadline; on October 14 Drupal patched RCE flaws CVE-2026-108097 (core Field UI) and CVE-2026-108099 (Entity List), warning exploits could appear "within hours or days" — neither component exposes the flaw on its own, requiring other contributed modules or custom code, in some cases without authentication, and no public exploitation has been reported so far (securityweek.com). CISA has flagged five exploited Drupal vulnerabilities in recent years, two abused by ransomware gangs (bleepingcomputer.com). On the PHP2Shell front, Wiz reports the share of significantly affected organizations fell to 52.1% as of October 25. Wiz observed two activity types: attempts matching public PoC exploit mechanics, and PHP2Shell-branded tooling unrelated to the CVEs that instead abused session poisoning and a separate local file inclusion vulnerability. Wiz notes memory exhaustion alone is insufficient to complete the chain, as PHP builds, memory limits and worker behavior vary.
Remediação
- Upgrade Commerce Core 3.x to 3.3.13.
- Upgrade earlier versions to Commerce Core 8.x-2.41.
- Audit orders for inconsistencies that may indicate abuse (bleepingcomputer.com).
- Review the other 38 advisories from October 28 across 21 contributed projects, notably CAPTCHA and Media Alias Display (securityweek.com).
- Patch PHP against CVE-2026-109618 / CVE-2026-109619 and hunt for LFI and session poisoning abuse.
Linha do tempo
-
Drupal warns of in-the-wild exploitation of Commerce Core access bypass CVE-2026-118539
SecurityWeek adds detail on the broader October 28 Drupal release: 38 further advisories covering 21 contributed projects, nearly a dozen critical, including RCE, account takeover, and a flaw letting Commerce orders via Stripe be marked as paid without payment. It also reports a CAPTCHA module fix for a challenge-replay bug with exploit code in the wild, public PoCs for two information disclosure flaws (Commerce Core and Media Alias Display), the 21/25 Drupal risk score for CVE-2026-118539 confirming unauthenticated exploitability in any configuration, and that no public exploitation of the October 14 RCE flaws has been observed.
ler a análise desta fonte ocultar
SecurityWeek adds detail on the broader October 28 Drupal release: 38 further advisories covering 21 contributed projects, nearly a dozen critical, including RCE, account takeover, and a flaw letting Commerce orders via Stripe be marked as paid without payment. It also reports a CAPTCHA module fix for a challenge-replay bug with exploit code in the wild, public PoCs for two information disclosure flaws (Commerce Core and Media Alias Display), the 21/25 Drupal risk score for CVE-2026-118539 confirming unauthenticated exploitability in any configuration, and that no public exploitation of the October 14 RCE flaws has been observed.
Drupal is urging operators of online stores to patch CVE-2026-118539, a highly critical access bypass in the contributed Commerce Core module, confirmed to be exploited in the wild. The module, used on more than 42,000 sites, insufficiently protects certain routes and entity fields, which "may financially impact the vendor." Drupal assigned a risk score of 21/25, meaning unauthenticated attackers can exploit the flaw regardless of module configuration. Drupal has not disclosed how the bug is being exploited, who is behind it, how many sites are affected, or whether it was a zero-day. The October 28 release wave included 38 other advisories covering 21 contributed projects, nearly a dozen rated critical (securityweek.com).
Technical Details
Affected versions are 3.x before 3.3.13 and earlier releases before 8.x-2.41. Among the other October 28 advisories are bugs leading to remote code execution, account takeover, and Commerce orders via Stripe being marked as paid without payment. The CAPTCHA module received a fix for a moderately critical issue allowing a protected form to be resubmitted without solving a new challenge, with Drupal's rating indicating exploit code exists in the wild (no confirmed active exploitation). Drupal's ratings also indicate public proofs of concept for two information disclosure bugs, one in Commerce Core and one in Media Alias Display. The October 14 RCE fixes, CVE-2026-108097 (core Field UI) and CVE-2026-108099 (Entity List), require certain contributed modules or custom code for exploitation, in some cases unauthenticated; no public exploitation reports so far. CVE-2026-9082, a SQL injection in the core database abstraction API affecting PostgreSQL-backed sites, drew exploitation attempts in May.
Remediation
- Update Commerce Core to 3.3.13 or 8.x-2.41.
- Audit store orders for inconsistencies, as the flaw is actively exploited.
- Review the 38 additional October 28 advisories across 21 contributed projects, including CAPTCHA and Media Alias Display.
-
Drupal Commerce Core flaw CVE-2026-118539 exploited in attacks on 42,000+ sites
BleepingComputer adds scope and context: Commerce Core is deployed on more than 42,000 websites including Fortune 500 firms and research universities, the advisory was published Wednesday, and Drupal explicitly advises auditing orders for inconsistencies. It also situates the flaw among other recently exploited Drupal issues (CVE-2026-9082 added to CISA KEV with a 3-day federal deadline, and RCE flaws CVE-2026-108097/CVE-2026-108099).
ler a análise desta fonte ocultar
BleepingComputer adds scope and context: Commerce Core is deployed on more than 42,000 websites including Fortune 500 firms and research universities, the advisory was published Wednesday, and Drupal explicitly advises auditing orders for inconsistencies. It also situates the flaw among other recently exploited Drupal issues (CVE-2026-9082 added to CISA KEV with a 3-day federal deadline, and RCE flaws CVE-2026-108097/CVE-2026-108099).
Drupal urged administrators to immediately patch CVE-2026-118539, a missing authorization flaw in the Commerce Core module that unauthenticated attackers are exploiting in the wild. The flaw affects Commerce Core 0.0.0 through 2.41 and 3.0.0 through 3.3.13, and allows an access bypass that "may financially impact the vendor." Commerce Core is used by more than 42,000 websites, including Fortune 500 companies and research universities. Drupal rated the Wednesday advisory highly critical and asked admins to audit orders for inconsistencies after upgrading.
Technical Details
The module does not sufficiently protect certain routes and entity fields, exposing shopping cart, checkout and decoupled API functionality to unauthenticated access. Drupal has repeatedly warned of exploited flaws in 2026, including the SQL injection CVE-2026-9082 in the database abstraction API (added to the CISA KEV catalog with a three-day federal patch deadline) and RCE issues CVE-2026-108097 and CVE-2026-108099. CISA has flagged five exploited Drupal vulnerabilities in recent years, two of which were abused by ransomware gangs.
Remediation
- Upgrade Commerce Core 3.x to 3.3.13.
- Upgrade earlier versions to Commerce Core 8.x-2.41.
- Audit order records for inconsistencies indicating abuse.
-
Drupal Commerce Core authorization bypass CVE-2026-118539 actively exploited in the wild
ler a análise desta fonte ocultar
Drupal has issued a "highly critical" advisory for CVE-2026-118539, a missing authorization flaw in Commerce Core affecting versions 0.0.0–2.41 and 3.0.0–3.3.13. The module insufficiently protects certain routes and entity fields, enabling an access bypass that may financially impact vendors running online stores. Drupal confirmed the flaw is actively exploited in the wild but shared no details about the campaign or its scope. Separately, two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2), collectively dubbed PHP2Shell, continue to see exploitation attempts.
Technical Details
The Commerce Core issue stems from inadequate route and entity field protection, allowing unauthorized access to commerce functionality (shopping cart, checkout, and decoupled API endpoints). On the PHP2Shell front, Wiz reports the share of significantly affected organizations fell to 52.1% as of October 25. Wiz observed two activity types: attempts matching public PoC exploit mechanics, and PHP2Shell-branded tooling unrelated to the CVEs that instead abused session poisoning and a separate local file inclusion vulnerability. Wiz notes memory exhaustion alone is insufficient to complete the chain, as PHP builds, memory limits and worker behavior vary.
Remediation
- Upgrade Commerce Core 3.x to 3.3.13.
- Upgrade earlier versions to Commerce Core 8.x-2.41.
- Patch PHP against CVE-2026-109618 / CVE-2026-109619 and hunt for LFI and session poisoning abuse.