---
schema: 1
kind: vulnerability
title: "CVE-2026-118539, Drupal Commerce Core: an access bypass in routes and entity fields is exploited against online stores, fixed in 3.3.13 and 8.x-2.41 (Drupal risk 21 of 25)"
headline: "Drupal Commerce Core access bypass is exploited in the wild; update to 3.3.13 or 8.x-2.41 and audit orders"
summary: >
  Drupal's advisory SA-CONTRIB-2026-254 of 2026-10-28 says an access bypass in the Commerce Core module, which adds a shopping cart and checkout to Drupal sites, is being actively exploited in the wild; the Drupal security team scores it 21 of 25, needing no authentication and affecting every module configuration. Commerce Core 3.0.0 up to but not including 3.3.13, and earlier releases before 8.x-2.41, are affected, and Drupal tells operators to update and audit their orders for inconsistencies. NCSC Switzerland issued its own advisory on 2026-10-30; Drupal says nothing on the method, the actor or the number of sites hit.
discovered_at: "2026-10-31T03:47:00Z"
updated_at: null
event_date: "2026-10-28"
run_id: 2026-10-31T0256Z-intel
priority: notable
immediate_action: null
tags: [vulnerabilities, pre-auth, auth-bypass, actively-exploited, patch-available]
regions: [global]
sectors: [technology]
entities: ["product:drupal-commerce-core"]
techniques: [T1190, T1565.001]
affected_products: ["Drupal Commerce Core"]
cves:
  - id: CVE-2026-118539
    cvss: "n/a"
    epss: null
    type: auth-bypass
    vector: zero-click
    auth: pre-auth
    status: [exploited, patch-available]
    affected: "Commerce Core 3.0.0 up to but not including 3.3.13, and earlier releases before 8.x-2.41"
    fixed: "3.3.13 on the 3.x line; 8.x-2.41 on earlier releases"
sources:
  - url: "https://www.drupal.org/sa-contrib-2026-254"
    publisher: "Drupal Security Team (SA-CONTRIB-2026-254)"
    date: "2026-10-28"
    role: primary
  - url: "https://security-hub.ncsc.admin.ch/#/posts/13124"
    publisher: "NCSC Switzerland (Cyber Security Hub, post 13124)"
    date: "2026-10-30"
    role: corroborating
  - url: "https://www.securityweek.com/drupal-commerce-core-vulnerability-exploited-against-online-stores/"
    publisher: "SecurityWeek"
    date: "2026-10-30"
    role: corroborating
  - url: "https://thehackernews.com/2026/10/hackers-actively-exploit-highly.html"
    publisher: "The Hacker News"
    date: "2026-10-30"
    role: corroborating
closed_sources: []
evidence:
  - quote: "This vulnerability is being actively exploited in the wild."
    publisher: "Drupal Security Team (SA-CONTRIB-2026-254)"
    source_url: "https://www.drupal.org/sa-contrib-2026-254"
  - quote: "Sites should audit their orders for inconsistencies as this vulnerability is being actively exploited"
    publisher: "SecurityWeek (quoting the Drupal advisory)"
    source_url: "https://www.securityweek.com/drupal-commerce-core-vulnerability-exploited-against-online-stores/"
  - quote: "Successful exploitation allows unauthenticated attackers to bypass access controls and manipulate order-related data, potentially causing financial losses for online store vendors via network access."
    publisher: "NCSC Switzerland (Cyber Security Hub, post 13124)"
    source_url: "https://security-hub.ncsc.admin.ch/#/posts/13124"
  - quote: "Drupal has confirmed the attacks but has not said how the bug is being exploited, who is behind the activity, or how many sites have been targeted."
    publisher: "SecurityWeek"
    source_url: "https://www.securityweek.com/drupal-commerce-core-vulnerability-exploited-against-online-stores/"
verification: multi-source
sourcing_note: >
  Drupal's advisory is the vendor primary; its wording is carried from SecurityWeek, The Hacker News and NCSC Switzerland, which quote it, and all three restate Drupal's own exploitation statement rather than confirming it independently. The CVSS score is not published (Drupal uses its own 25-point risk scale), and no source says how or since when the flaw is exploited.
confidence: high
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: A
  credibility: 2
watchlist_hit: false
actions:
  - "Update Commerce Core on every Drupal site to 3.3.13 (3.x) or 8.x-2.41 (earlier releases) now, then audit orders back as far as your logs reach for inconsistencies, because Drupal says the flaw is exploited, names no other mitigation and does not say when exploitation began."
updates: []
migrated_from: null
---

Drupal's advisory SA-CONTRIB-2026-254 of 2026-10-28 says Commerce Core "doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor" and that the flaw is being actively exploited in the wild ([Drupal Security Team, 2026-10-28](https://www.drupal.org/sa-contrib-2026-254)); The Hacker News carries the same wording ([The Hacker News, 2026-10-30](https://thehackernews.com/2026/10/hackers-actively-exploit-highly.html)). The Drupal security team scores it 21 of 25, which SecurityWeek reads as exploitable without authentication whatever the module's configuration, and Drupal's statistics put the module on more than 42,000 sites ([SecurityWeek, 2026-10-30](https://www.securityweek.com/drupal-commerce-core-vulnerability-exploited-against-online-stores/)). The affected releases are Commerce Core 3.0.0 up to but not including 3.3.13 and earlier releases before 8.x-2.41 ([SecurityWeek, 2026-10-30](https://www.securityweek.com/drupal-commerce-core-vulnerability-exploited-against-online-stores/)). Drupal has not said how the bug is exploited, by whom, how many sites were targeted or whether it was exploited before the fix ([SecurityWeek, 2026-10-30](https://www.securityweek.com/drupal-commerce-core-vulnerability-exploited-against-online-stores/)); NCSC Switzerland's advisory of 2026-10-30 describes the impact as unauthenticated manipulation of order-related data with financial loss for the shop operator ([NCSC Switzerland, 2026-10-30](https://security-hub.ncsc.admin.ch/#/posts/13124)).

**Exposure:** any Drupal site running Commerce Core below 3.3.13 on 3.x or below 8.x-2.41 on earlier releases, including shops built on the module's decoupled APIs rather than its own cart and checkout ([The Hacker News, 2026-10-30](https://thehackernews.com/2026/10/hackers-actively-exploit-highly.html)); a public body that sells goods, permits or fees through such a site is in scope. The same day's batch holds 38 further Drupal advisories for 21 contributed projects, nearly a dozen rated critical, among them code execution, account takeover and Commerce orders marked as paid through Stripe without payment ([SecurityWeek, 2026-10-30](https://www.securityweek.com/drupal-commerce-core-vulnerability-exploited-against-online-stores/)).

**Detection:** Drupal's own guidance is an order audit for inconsistencies ([SecurityWeek, 2026-10-30](https://www.securityweek.com/drupal-commerce-core-vulnerability-exploited-against-online-stores/)); checking each order's state, totals and payment status against the payment provider's records is the obvious test, an inference since no source names a method. The sources name no routes, parameters or request patterns; the web-server access log of the shop's API and checkout routes is the other record to review, an inference since nothing describes the requests.

**Defender takeaway:** update Commerce Core to 3.3.13 or 8.x-2.41 now and audit orders; the flaw needs no login and the upgrade is the only mitigation the sources name. Check the other contributed modules the site runs against the advisories of 2026-10-28.