Security Guides

#vulnerability #CVE-2026-118539 #Drupal #Drupal Commerce #e-commerce #access bypass #exposed services

Drupal Commerce Core CVE-2026-118539: unauthenticated access bypass, actively exploited (update to 8.x-2.41 or 3.3.13)

Drupal's SA-CONTRIB-2026-254 (October 28) rates a Commerce Core access bypass Highly critical and says it is exploited in the wild. Affected versions, fixed releases 8.x-2.41 and 3.3.13, why NVD scores it 6.5, and how to audit your orders.

Published 2026-10-31 Updated 2026-10-31 Last verified 2026-10-31 5 min read

On this page

Audience: owners and developers of online shops built on Drupal Commerce. This page is based on Drupal's security advisory and NVD; it contains no attack steps or exploit code.

Developing: this page will be updated as more is published

As of October 31, 2026 (JST)

Not yet known

What exactly attackers do with the bypass, and how many shops are affected (Drupal gives no details)
NVD's own analysis (status: Awaiting Analysis, October 30)
Whether CISA adds it to the KEV catalog

Drupal published SA-CONTRIB-2026-254 on October 28 with fixed versions, and says the flaw is being actively exploited. We checked the advisory, NVD and CISA's KEV feed on October 31.

What to do today

Find your Commerce Core version

Check the Commerce Core (machine name commerce) version in your Composer lock file or on the Drupal Extend page. Affected: below 8.x-2.41, and 3.0.0 up to but not including 3.3.13.

Update

Move to 3.3.13 if you use 3.x, or 8.x-2.41 if you use the 2.x line, as Drupal's advisory says. Test on staging if you can, but do not leave production on an affected version while you test for long.

Audit orders and payments

Drupal says sites should audit their orders for inconsistencies. Our suggestions: reconcile paid or completed orders against your payment provider's records, and look for unexpected prices, totals, order states or customer fields. Exploitation may predate the October 28 advisory, so a review starting on October 28 may not be enough; go back as far as your logs allow.

Preserve logs, then check for other signs

Keep web server and application logs from before the update. If you find anything that cannot be explained, involve your developer and payment provider, and consider your reporting duties under the data protection and payment-card rules that apply to you (our judgment).

What was disclosed

Commerce Core access bypass (CVE-2026-118539, SA-CONTRIB-2026-254)

Product: Commerce Core (machine name commerce), a Drupal module for selling through a cart, checkout and APIs
Type: Access bypass. The module does not sufficiently protect certain routes and entity fields (Drupal). NVD: missing authorization (CWE-862), forceful browsing
Severity: Drupal: Highly critical, 21/25; no access complexity, no authentication, some confidentiality and integrity impact, exploit in the wild, all configurations exploitable. NVD record: CVSS v3.1 6.5 (added by CISA-ADP)
Affected: Below 8.x-2.41; 3.0.0 up to but not including 3.3.13
Fixed: 8.x-2.41 and 3.3.13
Exploitation: Drupal: "being actively exploited in the wild." No detail on who or how widely
Published: October 28, 2026 (Drupal). NVD record created October 30

Why two ratings differ: Drupal's score is its own 25-point scale that counts an exploit being available and every configuration being exploitable. NVD's 6.5 comes from the CVSS formula for the technical impact and does not model exploitation. Neither is wrong, but the first better tells you how urgent it is. NVD's record also shows CISA-ADP (coordinator) listing exploitation as "none" on October 30; Drupal, the maintainer, says it is active, so we follow Drupal's statement.

1. Check the version

Below 8.x-2.41 or 3.3.13 is affected

2. Update

8.x-2.41 or 3.3.13

3. Audit orders

Reconcile with payment provider records

Order of work today, per Drupal's advisory and our suggestions.

Timeline

October 28
The Drupal Security Team publishes SA-CONTRIB-2026-254 with fixed versions and says the flaw is being actively exploited.
October 30
NVD creates a record for CVE-2026-118539 (Awaiting Analysis; CVSS 6.5 from CISA-ADP).

What is known and not known

Item	Status
Exploitation	Stated by Drupal; no details
Affected and fixed versions	Published by Drupal (see above)
NVD	Awaiting Analysis; CVSS 6.5 from CISA-ADP
CISA KEV	Not listed as of October 31
Scale of attacks and what was done to orders	Not disclosed

Sources

Checked on October 31, 2026 (JST).

Drupal.org, "Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254" (October 28, 2026) — drupal.org
NVD, CVE-2026-118539 — nvd.nist.gov
CISA, Known Exploited Vulnerabilities Catalog (checked October 31; not listed) — cisa.gov

Update history

2026-10-31: First version, based on Drupal's advisory and NVD.

Latest breaking reports

All breaking reports →

FAQ

QWhat happened?

On October 28, 2026, the Drupal Security Team published SA-CONTRIB-2026-254: the Commerce Core module (CVE-2026-118539) does not sufficiently protect certain routes and entity fields, allowing an access bypass. Drupal rates it Highly critical and says it is being actively exploited in the wild.

QWhich versions are affected, and which are fixed?

Per Drupal, versions below 8.x-2.41 and 3.0.0 up to but not including 3.3.13 are affected. Fixed versions are 8.x-2.41 (for the 2.x line) and 3.3.13 (for 3.x).

QWhy does Drupal say Highly critical but NVD says 6.5?

They use different scales. Drupal's 21/25 score combines factors such as no required authentication and an exploit in the wild. NVD's record carries a CVSS v3.1 score of 6.5 (low confidentiality and integrity impact, no authentication), added to the NVD record by CISA's ADP, and NVD's own analysis is not done. A CVSS score does not include the fact that it is being exploited. Treat it as urgent.

QWhat could an attacker do?

Drupal says only that the bypass may have a financial impact on the vendor (the shop). It does not describe the exact actions, and we do not speculate. Drupal tells sites to audit their orders for inconsistencies.

QHow do I audit my orders?

Drupal's advice is to audit orders for inconsistencies. As a starting point (our suggestion), compare orders marked paid or completed with your payment provider's records, and look for orders with unexpected totals, prices, statuses or customer details over as wide a period as you can. Check the dates against when you last updated.

QIs it in CISA's KEV catalog?

Not as of October 31, 2026. NVD's record also shows CISA-ADP (coordinator) listing exploitation as none (October 30), which predates or disagrees with Drupal's statement. Drupal's advisory is the primary source here.