Drupal Commerce Access Bypass Exploited in the Wild

Attackers are exploiting a highly critical access bypass in Drupal Commerce, the shopping-cart and checkout software for Drupal websites, the Drupal Security Team said in advisory SA-CONTRIB-2026-254. The flaw, tracked as CVE-2026-118539, is fixed in Commerce Core 3.3.13, and in 8.x-2.41 for sites on the older branch.

The advisory went out on Wednesday 28 October at 16:54 GMT with an unusual instruction attached: patching alone is not the whole job. “Sites should audit their orders for inconsistencies as this vulnerability is being actively exploited,” the Security Team wrote. Drupal has given no count of affected shops and no figure for losses.

In brief

Drupal rates the Commerce Core access bypass CVE-2026-118539 “Highly critical”, 21 out of 25, and says it “is being actively exploited in the wild”.
Shops on the 3.x line should update to Commerce Core 3.3.13 and those on earlier versions to 8.x-2.41, then audit their orders for inconsistencies.
Drupal has not said how many sites were attacked or what was lost, and the US National Vulnerability Database had not scored the flaw by Friday morning.

Why the Drupal Commerce flaw scores 21 out of 25

Commerce Core lets a site “sell goods and services to customers through an included shopping cart and checkout form or through decoupled applications via APIs”, the advisory says. The bug is that the module “doesn’t sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor”. The vendor here is the shop running the software.

Drupal scores contributed-module flaws out of 25, and 21 puts this one in its “Highly critical” band. The score’s components spell out why: no access complexity, no login required, some impact on both the confidentiality and integrity of data, an exploit already in existence, and every site using the module in its default configuration in scope. The CVE record that Drupal published early on Friday classifies the weakness as CWE-862, “Missing Authorization”.

The fixed releases were posted shortly before the advisory. Drupal’s release-history feed for the project lists Commerce Core 3.3.13 and 8.x-2.41 as security updates published on 28 October, and now marks the previous releases, 3.3.12 and 8.x-2.40, as insecure. The older 2.x branch had not had a release since August 2024, so sites still on it are being asked to take their first update in more than two years.

Five more Commerce Core advisories and a critical Stripe bug

SA-CONTRIB-2026-254 was the most serious of a batch the Security Team published on 28 October. Five further Commerce Core advisories, SA-CONTRIB-2026-255 to -259, cover two information-disclosure bugs involving unpublished product variations when the JSON:API module is enabled, two access bypasses affecting coupons and default-store settings, and a cross-site request forgery (CSRF) bug in the Commerce dashboard inbox. Drupal rates them “Moderately critical” or “Less critical”, and none is described as exploited.

The other bug rated “Critical” is in Commerce Stripe, the payment module. Advisory SA-CONTRIB-2026-263 says the module does not add a CSRF token when redirecting to Stripe Connect, which “could allow a an attacker to trick an administrator to click a link that bypasses Stripe payment for an order, meaning that the order would be marked as paid without any actual payment”. It scores 15 out of 25, and Drupal’s scoring marks exploitation as theoretical. The fix is Commerce Stripe 2.2.3; the 2.0.x and 2.1.x branches are no longer supported, and 8.x-1.x is not affected. The same day brought advisories for Commerce Shipping, Commerce License and two lesser Stripe issues.

The batch lands amid a run of exploited flaws in business software. This week TSN covered a Cisco ASA and FTD VPN zero-day under attack, and last week an exploited VeloCloud Orchestrator flaw that Arista patched. Earlier this month, attackers used a critical flaw in Collabora’s Nextcloud app to plant web shells.

How Drupal Commerce shops should respond

The Security Team’s instructions are short. Sites on version 3.x should upgrade to Commerce Core 3.3.13, which supports Drupal 10.3 and 11. Sites on an earlier version should upgrade to 8.x-2.41, which supports Drupal 9.3 and 10. Drupal Commerce shops that also use Commerce Stripe should move to 2.2.3 at the same time.

The second instruction is the audit. Drupal asks sites to review their orders for inconsistencies, but it has not said what inconsistencies to look for, and it has published no indicators of compromise. Shops that cannot tell whether they were targeted have only their own order records to go on.

As of Friday morning, CVE-2026-118539 was not in the US Cybersecurity and Infrastructure Security Agency’s catalogue of known exploited vulnerabilities, and the NVD listed it as received but not yet analysed.

Patching the Drupal Commerce flaw leaves the order audit still to do

The phrase that sets this advisory apart is “may financially impact the vendor”. The advisory frames the risk in terms of the shop’s money rather than data exposure alone, and Drupal pairs the fix with an instruction to check past orders. An update closes the gap from the moment it is applied, but it cannot reverse anything an attacker changed before then. For a Drupal Commerce shop, the audit is where any harm would actually be found.

The timing matters as well. The advisory and fixes appeared on 28 October, while the CVE record arrived on 30 October and the NVD has yet to score it. Teams that rely on CVE feeds, NVD scores or CISA’s catalogue to prioritise patches would have seen nothing for more than a day, even though Drupal had already said the flaw was being exploited. Drupal’s own advisory and update feed were the fastest signal.

The scoring also cuts against easy reassurance. With no login needed and the default configuration in scope, size is no protection: a small shop on the older 2.x branch is as exposed as a large one on 3.x. TeamViewer, by contrast, said it knew of no exploitation when it fixed its own recent flaw. Drupal has gone the other way, stating plainly that attacks are under way while saying nothing about their scale.

What to watch next is whether CISA adds CVE-2026-118539 to its catalogue, how the NVD scores it, and whether Drupal or the Commerce maintainers publish guidance on which order changes point to an attack.