Drupal Commerce Core CVE-2026-118539 (SA-CONTRIB-2026-254, rated Highly critical by Drupal): access bypass that may financially impact the vendor is being actively exploited; upgrade to Commerce Core 3.3.13 or 8.x-2.41 and audit orders
The Drupal Security Team published advisory SA-CONTRIB-2026-254 on 28 October 2026 for Commerce Core, the Drupal module for selling goods and services through a shopping cart and checkout form or through decoupled applications via APIs.
Drupal says the module "doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor", tracked as CVE-2026-118539, and that "this vulnerability is being actively exploited in the wild."
It rates the advisory Highly critical (Drupal risk score 21/25) and lists affected versions as <2.41 and >=3.0.0 <3.3.13.
Drupal says sites on 3.x should upgrade to Commerce Core 3.3.13, sites on earlier versions to Commerce Core 8.x-2.41, and that sites should audit their orders for inconsistencies. It credits Dan Puccetti, Marcus Johansson and Robert Snyder with reporting the flaw. (source: Drupal)
According to The Hacker News, Drupal gave no specifics about the nature of the activity or the extent of the campaign. (source: The Hacker News)
- Product
- Drupal Commerce Core module (machine name: commerce)
- Versions
- Affected (Drupal, as of 30 Oct): <2.41 || >=3.0.0 <3.3.13. Fixed: Commerce Core 3.3.13 (3.x) and Commerce Core 8.x-2.41 (earlier versions).
- CVSS
- not published; Drupal rates it Highly critical, risk score 21/25 (AC:None/A:None/CI:Some/II:Some/E:Exploit/TD:All), which is not a CVSS score
- Exploited in Australia?
- unknown
- Patch to
- Upgrade to Commerce Core 3.3.13 if you run 3.x, or Commerce Core 8.x-2.41 if you run an earlier version, as Drupal's advisory states. Because Drupal says the flaw is being actively exploited, audit your orders for inconsistencies, as the advisory advises.
- Primary: Drupal.org — Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254 (28 Oct 2026)
- Vendor: Drupal Security Team — SA-CONTRIB-2026-254
- CVE: CVE-2026-118539
- Source: The Hacker News — Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw (30 Oct 2026)