Drupal has published a security advisory about the CVE-2026-118539 vulnerability in the Commerce Core module, which provides online store functionality — shopping cart, checkout, and APIs for external applications. The vulnerability is classified as an access bypass: the module does not sufficiently protect certain routes and entity fields, which can lead to financial losses for store owners. Drupal rates the issue as highly critical (21/25 on its internal scale) and confirms that it is already being exploited in the wild. Affected are Commerce Core versions below 2.41 and from 3.0.0 through 3.3.12 inclusive. Site owners running Drupal with the Commerce module enabled must update immediately and audit their orders.
Technical details of the vulnerability
According to Drupal’s advisory dated October 28, 2026, CVE-2026-118539 is a missing authorization issue in Commerce Core. The vulnerability does not require authentication and does not depend on complex exploitation conditions — in Drupal terms: AC:None/A:None. This means an attacker can exploit the vulnerability without prior access to the system.
Affected versions:
- Commerce Core versions below 2.41
- Commerce Core versions from 3.0.0 to 3.3.12 inclusive
A CVSS score had not been assigned at the time the advisory was published (N/A in NVD). However, Drupal’s internal score of 21 out of 25 points with the “Exploit” flag in the exploitability field indicates a real and confirmed threat. It is important to note that confirmation of active exploitation comes solely from Drupal itself; no independent confirmation from third-party researchers or inclusion in the CISA KEV catalog has been found so far.
The vulnerability was discovered by researchers Dan Puccetti, Marcus Johansson, and Robert Snyder.
Impact assessment
Commerce Core is one of the key modules in the Drupal e-commerce ecosystem. An authorization bypass vulnerability in such a component directly threatens the financial integrity of transactions. Drupal explicitly points to potential financial damage for merchants — this may include price manipulation, bypassing payment checks, or unauthorized access to order data.
The impact surface of CVE-2026-118539 is limited to specific versions of the Commerce Core module. This distinguishes the vulnerability from the concurrently discussed PHP2Shell issues, which affect the PHP interpreter itself and can potentially impact any PHP application regardless of the CMS used.
Relation to PHP2Shell and the broader threat landscape
The Drupal advisory was released against the backdrop of ongoing activity around two critical vulnerabilities in the PHP core — CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell (CVSS up to 9.2). Both vulnerabilities are included in the CISA KEV catalog. We have already analyzed these vulnerabilities in detail and tracked their inclusion in CISA KEV.
According to research by Wiz, technically CVE-2026-109618 is a use-after-free in the file upload tracking mechanism, while CVE-2026-109619 is a use-after-free in fatal error handling combined with a type confusion in OPcache. These vulnerabilities exist in PHP itself and do not depend on a specific application — impact has been demonstrated on WordPress, Drupal, and Joomla.
Wiz reports that it has observed a limited number of PHP2Shell exploitation attempts in its telemetry. Neither of the two detected exploit kit variants successfully completed the attack chain. Wiz did not find a publicly available universal PoC for full exploitation. The researchers note that exploitation reliability is significantly constrained by differences in PHP builds, memory limit settings, worker process behavior, and the need to bind sequential requests to the same process.
Wiz also observed the appearance of tools using the “PHP2Shell” brand but not actually exploiting the specified vulnerabilities — instead, they relied on session poisoning and a separate local file inclusion (LFI) vulnerability.
According to Wiz, a week after disclosure, fewer than 53% of the initially affected organizations remained vulnerable — a decrease of approximately 47.9%. PHP patches became available, according to Wiz, on October 21, 2026.
For Drupal administrators, this means two independent remediation tracks: updating the Commerce Core module closes CVE-2026-118539, but does not protect against PHP2Shell, which requires updating the PHP interpreter itself on the server.
Recommendations
Drupal recommends the following actions:
- For Commerce Core 3.x — update to version 3.3.13
- For earlier branches — update to version 8.x-2.41
- Audit orders for anomalies and discrepancies — Drupal explicitly recommends checking the integrity of order data
Additionally, for protection against PHP2Shell:
- Update PHP to a version that includes fixes for CVE-2026-109618 and CVE-2026-109619
- Keep in mind that CISA has set October 29, 2026 as the deadline for remediating PHP2Shell
Indicators of compromise (PHP2Shell)
Wiz has published IP addresses associated with PHP2Shell exploitation attempts:
- 85.11.187[.]35
- 172.206.2[.]199
- 3.37.227[.]134
- 103.151.172[.]95
- 178.249.214[.]6
- 31.56.197[.]72
- 135.136.19[.]197
- 15.204.59[.]70
- 162.35.99[.]94
Owners of sites running Drupal Commerce should treat updating Commerce Core as urgent — the vulnerability is being exploited, does not require authentication, and directly threatens financial transactions. At the same time, you must ensure that the PHP version on the server is updated to protect against PHP2Shell: these are two different attack vectors requiring two separate fixes, and closing one does not compensate for the other.
