A critical security vulnerability affecting Drupal Commerce has been identified, with evidence suggesting that the flaw was actively exploited in the wild two days before its official disclosure. The vulnerability, tracked as CVE-2026-118539, involves an access bypass issue within the Drupal Commerce core. Security researchers and tracking services noted that the exploit activity began on October 28, 2026, while the CVE was not formally published until October 30, 2026.
The vulnerability was officially acknowledged by the Drupal project through a security advisory, SA-CONTRIB-2026-254. This advisory provides the necessary guidance for administrators to secure their installations against the unauthorized access attempts that characterize this flaw. While the vulnerability has been documented, it has not yet been added to the Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog, nor has it appeared in the European Union Agency for Cybersecurity’s vulnerability database.
The claim of pre-disclosure exploitation currently rests on data provided by a single commercial vulnerability intelligence firm. While aggregators such as the Computer Incident Response Center Luxembourg have mirrored this information, they do not serve as independent verification of the activity. Consequently, while the timeline of the CVE reservation and publication is confirmed, the specific details regarding the scope and nature of the reported exploitation remain based on unverified external reporting.
The vulnerability carries an EPSS score of 0.67 percent, placing it in the 52.2nd percentile for potential exploitation risk. Despite the relatively low probability score, the timing of the observed activity—occurring immediately upon the reservation of the CVE identifier—highlights a persistent trend where threat actors monitor security disclosure pipelines to identify and weaponize vulnerabilities before patches or public warnings reach the broader administrative community.
Organizations utilizing Drupal Commerce are urged to consult the official Drupal security advisory to determine if their specific version is affected and to apply the necessary updates. Because the vulnerability allows for access bypass, the potential for unauthorized data exposure or administrative control is significant. Administrators should treat the advisory as a priority, particularly given the reports of early-stage exploitation attempts.
As of early November 2026, there have been no further reports of widespread, large-scale campaigns leveraging this specific vulnerability. However, the gap between the initial exploitation sighting and the formal publication of the CVE serves as a reminder of the importance of proactive patch management. Users are encouraged to monitor official Drupal channels for any subsequent updates or additional mitigation steps that may be released as more information regarding the exploit's mechanics becomes available.
