Drupal's security team warned that attackers are actively exploiting CVE-2026-118539, an access-bypass vulnerability in the Commerce Core module.

Insufficient protection of routes and entity fields could allow unauthorized changes with financial consequences for merchants.

E-commerce operators may face fraudulent or inconsistent orders. Applying a patch alone may not reveal changes attackers already made.

Upgrade Commerce Core 3.x to 3.3.13 or the older supported branch to 8.x-2.41, then audit orders for inconsistencies.

Drupal explicitly identifies exploitation in the wild. The advisory does not establish how many stores have been compromised.

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Core allows Stored XSS. This issue affects Commerce Core versions: from 3.3.0 to 3.3.6.