CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Drupal Commerce Core: access bypass in routes and entity fields exploited in the wild (SA-CONTRIB-2026-254, risk 21 of 25); fixed in 3.3.13 and 8.x-2.41

cve · CVE-2026-118539

Coverage
1
first 2026-10-31 → last 2026-10-31
Latest activity
2026-10-31
Drupal Commerce Core access bypass is exploited in the wild; update to 3.3.13 or 8.x-2.41 and audit orders
Peak priority
notable
1 notable
Targets
technology
sectors: technology
Sources cited
4
4 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-118539, newest first. Check the date before acting on an older one.

  • Update Commerce Core on every Drupal site to 3.3.13 (3.x) or 8.x-2.41 (earlier releases) now, then audit orders back as far as your logs reach for inconsistencies, because Drupal says the flaw is exploited, names no other mitigation and does not say when exploitation began.
    2026-10-31CVE-2026-118539

Defender insights

What each entry about CVE-2026-118539 tells a defender to do, newest first.

2026-10-31NOTABLEexploitedDrupal Commerce Core access bypass is exploited in the wild; update to 3.3.13 or 8.x-2.41 and audit orders

Exposure · detection

Story timeline

  1. 2026-10-31CVE-2026-118539, Drupal Commerce Core: an access bypass in routes and entity fields is exploited against online stores, fixed in 3.3.13 and 8.x-2.41 (Drupal risk 21 of 25)
    trending-vulnerabilitiesDrupal Commerce Core access bypass is exploited in the wild; update to 3.3.13 or 8.x-2.41 and audit orders

Hunting pivots

Affected products
Drupal Commerce Core
Tags
actively-exploitedauth-bypasspatch-availablepre-authvulnerabilities
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • ImpactData Manipulation: Stored Data Manipulation

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-10-31/cve-2026-118539-drupal-commerce-core-access-bypass-exploited · ATT&CK page ↗

Impact TA0040

T1565.001Data Manipulation: Stored Data Manipulation×1

Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data. By manipulating stored data, adversaries may attempt to affect a business process, organizational understanding, and decision making.

Evidence: 2026-10-31/cve-2026-118539-drupal-commerce-core-access-bypass-exploited · ATT&CK page ↗

Entries about Drupal Commerce Core: access bypass in routes and entity fields exploited in the wild (SA-CONTRIB-2026-254, risk 21 of 25); fixed in 3.3.13 and 8.x-2.41 (1)

2026-10-31 · view entry permalink →

NOTABLECVE-2026-118539exploitedNATOA2

CVE-2026-118539, Drupal Commerce Core: an access bypass in routes and entity fields is exploited against online stores, fixed in 3.3.13 and 8.x-2.41 (Drupal risk 21 of 25)

Drupal's advisory SA-CONTRIB-2026-254 of 2026-10-28 says Commerce Core "doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor" and that the flaw is being actively exploited in the wild (Drupal Security Team, 2026-10-28); The Hacker News carries the same wording (The Hacker News, 2026-10-30). The Drupal security team scores it 21 of 25, which SecurityWeek reads as exploitable without authentication whatever the module's configuration, and Drupal's statistics put the module on more than 42,000 sites (SecurityWeek, 2026-10-30). The affected releases are Commerce Core 3.0.0 up to but not including 3.3.13 and earlier releases before 8.x-2.41 (SecurityWeek, 2026-10-30). Drupal has not said how the bug is exploited, by whom, how many sites were targeted or whether it was exploited before the fix (SecurityWeek, 2026-10-30); NCSC Switzerland's advisory of 2026-10-30 describes the impact as unauthenticated manipulation of order-related data with financial loss for the shop operator (NCSC Switzerland, 2026-10-30).

This vulnerability is being actively exploited in the wild.

Drupal Security Team (SA-CONTRIB-2026-254) 2026-10-28

Sites should audit their orders for inconsistencies as this vulnerability is being actively exploited

SecurityWeek (quoting the Drupal advisory)

Successful exploitation allows unauthenticated attackers to bypass access controls and manipulate order-related data, potentially causing financial losses for online store vendors via network access.

NCSC Switzerland (Cyber Security Hub, post 13124) 2026-10-30

Drupal has confirmed the attacks but has not said how the bug is being exploited, who is behind the activity, or how many sites have been targeted.

SecurityWeek 2026-10-30
vulnerability31 Oct 03:47Zmulti-sourceOpen finding →
Sources: Drupal Security Team (SA-CONTRIB-2026-254) · NCSC Switzerland (Cyber Security Hub, post 13124) · SecurityWeek · The Hacker News

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • drupal.org1 (25%)
  • security-hub.ncsc.admin.ch1 (25%)
  • securityweek.com1 (25%)
  • thehackernews.com1 (25%)

External references

NVD · cve.org · CISA KEV

All cited sources (4)