Drupal’s security team has confirmed that a critical access-control flaw in the Commerce Core module, CVE-2026-118539, is being exploited in the wild. The advisory, SA-CONTRIB-2026-254, was published on October 28, 2026 and is rated “Highly critical” (21/25 on Drupal’s risk scale). At the time of writing the CVE has no published CVSS score and had not been added to CISA’s KEV catalog as of the 2026.10.29 catalog version.

What happened

Commerce Core is the foundation of Drupal Commerce, the e-commerce framework used for catalogs, carts, checkout and order management. According to the advisory, the module does not adequately guard certain routes and entity fields, which allows an access bypass. The attacker needs no account, and the advisory states that every configuration of the module is affected, so there is no “safe if you don’t enable feature X” workaround.

Drupal has deliberately withheld which routes and fields are involved. The advisory also gives no actor attribution, scale of exploitation or indicators of compromise. One trade outlet reports the flaw is being used to place fraudulent orders. That detail is not in Drupal’s advisory, so treat it as unconfirmed, though it is consistent with a bypass on order-related entities. Roughly 30,000 Drupal storefronts are reported to be potentially exposed.

Affected and fixed versions

Fixed releases:

  • Commerce Core 3.3.13 (3.x branch)
  • Commerce Core 8.x-2.41 (2.x branch)

Sources disagree slightly on the exact vulnerable range: the 2.x line up to and including the pre-fix release, and 3.0.0 up to but not including 3.3.13. Confirm against the SA-CONTRIB-2026-254 text for your branch rather than relying on secondary summaries.

Impact

Because the flaw is unauthenticated and exploitation is confirmed, any internet-facing Drupal Commerce site on an unpatched release should be assumed targeted. For a shop, the realistic impact is integrity loss in commerce data rather than classic server takeover: tampered prices, totals or order status, fraudulent orders, and potentially exposure of customer or order data held in the guarded entities. The advisory does not claim remote code execution. Since the exact primitive is undisclosed, do not assume the blast radius is limited to what has been reported so far.

Mitigation

  1. Upgrade now to Commerce Core 3.3.13 or 8.x-2.41 (for example composer update drupal/commerce), then clear caches and verify the installed version with composer show drupal/commerce.
  2. Audit orders, as Drupal itself recommends. Look for orders with unexpected prices, totals, adjustments or status changes, orders created without a corresponding checkout session or payment record, and bursts of orders from the same IP ranges or user agents.
  3. Review web server and WAF logs back to at least October 28 for unauthenticated requests hitting commerce routes (cart, checkout, order, and JSON:API or REST endpoints for commerce entities) that returned 200 where a 403 would be expected. Preserve logs before rotating them.
  4. Check payment reconciliation with your processor against the order table to catch orders marked paid without matching transactions.
  5. If you cannot patch immediately, consider restricting access to commerce endpoints at the edge or temporarily taking checkout offline; this is a stopgap, since the vulnerable routes are not publicly enumerated.
  6. Review admin accounts and recent configuration changes as a precaution, and rotate any API keys stored in commerce configuration if you find evidence of tampering.

Takeaways

This is a recurring pattern for CMS and e-commerce plugins: an authorization gap on routes or entity fields, disclosed with minimal detail, exploited before many operators have patched. Expect public technical analysis soon, which will shorten the window further. Drupal’s own risk score and the confirmed exploitation make this a patch-today item, even without a KEV entry.

References