VULNpocalypse
CriticalVulnerabilityPatch available

Drupal Commerce Core CVE-2026-118539: highly critical access bypass exploited against online stores

An exploited access bypass in Drupal Commerce Core can cost store owners money. Update to Commerce 3.3.13 or 8.x-2.41 and audit recent orders.

Published
Updated
Fixed in
Commerce Core 3.3.13, 8.x-2.41
Exploitation
Yes, Drupal says it is “being actively exploited in the wild” (28 October 2026); not in CISA KEV as of 30 October

Live scores

CVE-2026-118539
EPSS
0.003
low predicted chance of attack
VEDAS
0.509
some exploit evidence
On CISA KEV
Not listed
Detection rule
None yet

What happened

On 28 October 2026, the Drupal Security Team published SA-CONTRIB-2026-254 for Commerce Core, the main ecommerce module for Drupal. The module “does not sufficiently protect certain routes and entity fields”. That allows an access bypass that “may financially affect the vendor” (Drupal).

Drupal rates it Highly critical, 21 out of 25. In Drupal’s scoring string, access complexity and authentication are both None, an exploit exists, and the target distribution is All, meaning every configuration of the module is exposed (AC:None/A:None/CI:Some/II:Some/E:Exploit/TD:All) (Drupal). The CVE record classes it as missing authorization (CWE-862). CISA’s added CVSS 3.1 score is 6.5, which does not match Drupal’s own rating (CVE record).

It is exploited. The advisory says the vulnerability “is being actively exploited in the wild” (Drupal). Drupal gave no detail on the attacks, the campaign or the number of sites (The Hacker News). Neither source publishes indicators of compromise. The CVE was not in CISA’s KEV catalog as of the 30 October release (CISA KEV).

Dan Puccetti, Marcus Johansson and Robert Snyder reported it (Drupal).

Am I affected?

You are affected if Commerce Core is installed at a version earlier than 8.x-2.41, or 3.0.0 up to but not including 3.3.13 (Drupal). The CVE record’s text says “from 0.0.0 to 2.41, from 3.0.0 to 3.3.13”, which reads as if the fixed versions were included. Its structured data and the Drupal advisory agree that 3.3.13 and 8.x-2.41 are fixed (CVE record).

bash
# From the Drupal project root
composer show drupal/commerce | grep -E '^versions'

# Or with Drush
drush pm:list --filter=commerce --fields=name,status,version

Also check sites built from distributions or install profiles that pull Commerce in as a dependency, and staging copies that share a database with production.

What to do now

  1. Update Commerce Core. On 3.x, go to 3.3.13. On anything older, go to 8.x-2.41 (Drupal). Then run database updates and clear caches:
bash
composer update drupal/commerce --with-all-dependencies
drush updatedb -y && drush cache:rebuild
  1. Audit your orders. Drupal tells sites to “audit their orders for inconsistencies” because of active exploitation (Drupal). The advisory does not say which fields or routes attackers use. Compare order totals, line item prices, adjustments and payment state against what your payment provider actually captured. Drupal does not say when exploitation started, so cover the whole period before you updated.
  2. Hold suspect orders. Do not ship orders where the paid amount and the order total disagree until you have checked them against your payment provider’s records.

Sources