Critical Drupal Commerce Vulnerability Could Let Hackers Buy Products for Just $0.01
Critical Drupal Commerce vulnerability (CVE-2026-118539) allows attackers to bypass access checks and manipulate
Drupal has disclosed a highly critical vulnerability (CVE-2026-118539) in Commerce Core that allows attackers to bypass access checks on routes and entity fields, potentially enabling unauthorized price manipulation and financial losses for online stores. The flaw affects Commerce Core versions before 2.41 and 3.0.0 through 3.3.12, with active exploitation already confirmed. Drupal advises immediate patching and auditing of orders for inconsistencies to detect potential exploitation.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Drupal?
Get an email when a new story names Drupal, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA critical vulnerability in Drupal's Commerce Core module allows attackers to bypass access controls on routes and entity fields, enabling them to manipulate product prices to near-zero values and cause direct financial harm to online retailers. The flaw is already being actively exploited in the wild, meaning every day without patching increases exposure to real monetary losses. This incident highlights the danger of delayed patching in e-commerce environments where application-layer vulnerabilities have immediate, quantifiable business impact. Organizations running Drupal Commerce must treat critical CMS vulnerabilities with the same urgency as infrastructure-level flaws, given the direct path from exploitation to financial damage.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-118539