The Canadian Centre for Cyber Security issued an advisory on October 30, 2026, regarding an access bypass vulnerability in Drupal Commerce Core. According to open-source reporting, the flaw is being exploited in the wild.
Vulnerability Details
The Canadian Centre for Cyber Security reported that Drupal is affected by an access bypass vulnerability in Commerce Core. The affected versions include Commerce Core versions prior to 2.41 and 3.0.0 versions prior to 3.3.13.
The vulnerability is tracked as CVE-2026-118539 and classified as highly critical under advisory reference SA-CONTRIB-2026-254. Open-source reporting indicates that CVE-2026-118539 is being exploited in the wild.
Advisory Guidance
The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
What to do
- Review the provided web links and apply any necessary updates as they become available.
Key facts and where they come from
- Commerce Core versions prior to 2.41 and 3.0.0 versions prior to 3.3.13 are affected.
Versions prior to 2.41 and 3.0.0 versions prior to 3.3.13
- Open-source reporting indicates that CVE-2026-118539 is being exploited in the wild.
Open-source reporting indicates that CVE-2026-118539 is being exploited in the wild.
- The Cyber Centre encourages users and administrators to review web links and apply updates.
The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
