2026-10-31
Drupal Commerce Core CVE-2026-118539: unauthenticated access bypass, actively exploited (update to 8.x-2.41 or 3.3.13)
On October 28, 2026, the Drupal Security Team published SA-CONTRIB-2026-254 for the Commerce Core module (CVE-2026-118539). The module does not sufficiently protect certain routes and entity fields, which allows an access bypass that may have a financial impact on the shop owner. Drupal rates it Highly critical (21/25), requiring no authentication, and states that it is being actively exploited in the wild. Affected versions are below 8.x-2.41 and 3.0.0 up to but not including 3.3.13; fixed versions are 8.x-2.41 and 3.3.13. NVD's record shows a lower CVSS v3.1 score of 6.5 added by CISA's ADP and is still awaiting analysis. As of October 31 it is not in CISA's KEV catalog. Our conclusion: if you run an online shop on Drupal Commerce, update now and audit recent orders and payments for anything inconsistent.