Our takeDrupal's Commerce Core carries an actively exploited vulnerability (CVE-2026-118539) in versions before 2.41 and 3.3.13. Update immediately if you run it.Security Resilience desk
Sources (1)
- cccs · cccs
What this means for you — Security leader:Apply the Drupal Commerce Core security update to versions 2.41 or 3.3.13 (or later) immediately; CVE-2026-118539 is under active exploitation per CCCS advisory AV26-1105.
What this means for you — Lean IT orgs:If you run a Drupal site with the Commerce module, update it to version 2.41 or 3.3.13 (or newer) right away. This fixes a vulnerability already being exploited.
What this means for you — MSP:Audit all client Drupal instances for Commerce Core; update any installations below 2.41 / 3.3.13 immediately as CVE-2026-118539 is actively exploited.
What this means for you — Researcher:CCCS AV26-1105 confirms in-the-wild exploitation of CVE-2026-118539 in Drupal Commerce Core <2.41 and <3.3.13.