CVE-2026-118539, Drupal Commerce Core: an access bypass in routes and entity fields is exploited against online stores, fixed in 3.3.13 and 8.x-2.41 (Drupal risk 21 of 25)
Drupal Commerce Core access bypass is exploited in the wild; update to 3.3.13 or 8.x-2.41 and audit orders
Defender actions
- Update Commerce Core on every Drupal site to 3.3.13 (3.x) or 8.x-2.41 (earlier releases) now, then audit orders back as far as your logs reach for inconsistencies, because Drupal says the flaw is exploited, names no other mitigation and does not say when exploitation began.
Analysis
Drupal's advisory SA-CONTRIB-2026-254 of 2026-10-28 says Commerce Core "doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor" and that the flaw is being actively exploited in the wild (Drupal Security Team, 2026-10-28); The Hacker News carries the same wording (The Hacker News, 2026-10-30). The Drupal security team scores it 21 of 25, which SecurityWeek reads as exploitable without authentication whatever the module's configuration, and Drupal's statistics put the module on more than 42,000 sites (SecurityWeek, 2026-10-30). The affected releases are Commerce Core 3.0.0 up to but not including 3.3.13 and earlier releases before 8.x-2.41 (SecurityWeek, 2026-10-30). Drupal has not said how the bug is exploited, by whom, how many sites were targeted or whether it was exploited before the fix (SecurityWeek, 2026-10-30); NCSC Switzerland's advisory of 2026-10-30 describes the impact as unauthenticated manipulation of order-related data with financial loss for the shop operator (NCSC Switzerland, 2026-10-30).
Cited evidence
This vulnerability is being actively exploited in the wild.
Sites should audit their orders for inconsistencies as this vulnerability is being actively exploited
Successful exploitation allows unauthenticated attackers to bypass access controls and manipulate order-related data, potentially causing financial losses for online store vendors via network access.
Drupal has confirmed the attacks but has not said how the bug is being exploited, who is behind the activity, or how many sites have been targeted.
Sources4
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.