Drupal has warned that threat actors are actively exploiting a highly critical security flaw in its Commerce Core component, a widely used module for running e-commerce functions on Drupal websites. For businesses that use Drupal Commerce to sell products or services online, the issue raises an immediate website security and operational risk.

What happened

According to Drupal, the vulnerability affects Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13. The flaw is tracked as CVE-2026-118539 and has been described as a missing authorization issue.

In practical terms, a missing authorization flaw can allow actions to be performed without the correct permission checks. In an e-commerce context, that can be particularly serious because Commerce Core supports key online sales functions such as carts, orders and customer purchase workflows.

Drupal has also stated that the vulnerability is being actively exploited, which materially increases the urgency for affected organisations. The source material does not provide further verified technical details about the attack methods or the precise impact of exploitation.

Why it matters for European businesses

For European companies, especially SMEs that rely on Drupal-based online stores, this is more than a technical maintenance issue. A flaw in an e-commerce core component can affect revenue, customer trust, business continuity and potentially data protection obligations if an incident leads to unauthorised access or misuse.

Businesses running self-hosted e-commerce platforms are responsible for their own patching and security operations. Unlike purely managed SaaS commerce platforms, open-source deployments require organisations or their digital partners to monitor security advisories and apply fixes quickly.

The warning is also relevant for companies working with agencies or external developers. Even when a third party manages the website, the commercial and reputational impact of downtime, checkout disruption or account misuse still falls on the business.

Who may be affected

• Drupal Commerce site owners running affected Commerce Core versions
• SMEs and mid-sized online retailers using Drupal for direct sales
• Digital agencies and IT teams responsible for maintaining client e-commerce platforms
• B2B service providers that sell bookings, subscriptions or services through Drupal Commerce workflows

Organisations with custom Drupal builds may be especially exposed if Commerce Core is embedded in a broader platform and security updates are not applied routinely.

What companies should consider

• Identify exposure immediately. Check whether any public-facing or internal commerce websites use Drupal Commerce Core and confirm the installed version.
• Review Drupal's official security advisory. Use Drupal's own guidance to determine the fixed version and recommended remediation steps.
• Prioritise patching. Because Drupal says exploitation is already happening, affected systems should be treated as urgent.
• Assess for signs of compromise. Review admin activity, order workflows, access logs and other relevant site events for unusual behaviour, especially on internet-facing commerce systems.
• Coordinate with hosting and development partners. If your website is maintained by an external agency or provider, confirm who is responsible for patching, validation and rollback planning.
• Prepare customer and incident response steps. If exploitation has affected transactions, accounts or personal data, businesses may need legal, operational and communications follow-up depending on the facts of the incident.

For European businesses, the immediate priority is operational: determine whether Drupal Commerce Core is in use, verify version exposure and follow official remediation guidance without delay.