Summary
The Drupal Security Team has warned that attackers are exploiting a highly critical missing-authorization flaw in the Commerce Core module. Tracked as CVE-2026-118539 (advisory SA-CONTRIB-2026-254, published October 28, 2026), the bug scores 21/25 on Drupal's risk scale. No CVSS score has been assigned yet.
Technical Details
| Attribute | Value |
|---|---|
| CVE | CVE-2026-118539 |
| Weakness | Missing Authorization (CWE-862) |
| Advisory | SA-CONTRIB-2026-254 |
| Affected | Commerce Core 0.0.0 through 2.41 and 3.0.0 through 3.3.13 (before the fixed releases) |
| Fixed | 3.3.13 on the 3.x branch; 8.x-2.41 on earlier versions |
Commerce Core does not sufficiently protect certain routes and entity fields, producing an access bypass that "may financially impact the vendor." Drupal has not published technical details or described the scope of exploitation. The issue was reported by Dan Puccetti, Marcus Johansson and Robert Snyder.
Three other Commerce Core CVEs were published the same day (CVE-2026-118542, CVE-2026-118543 and CVE-2026-118544, covering incorrect authorization, CSRF and sensitive information exposure), so updating fully is important.
Conflicting Signals
Drupal's advisory and The Hacker News state exploitation is under way, and an EUVD record cites a VulnCheck KEV entry dated October 28. Some aggregators, however, still list the flaw as not exploited, likely lagging. Treat it as exploited.
Recommendations
- Upgrade Commerce Core to 3.3.13 (3.x) or 8.x-2.41 (earlier versions) immediately.
- Audit orders for inconsistencies: unexpected totals, altered prices or payment states, refunds, and orders created or modified by unusual accounts.
- Review web server logs for unusual requests to Commerce order, cart and checkout routes since at least October 28.
- Review payment gateway records against store orders to identify mismatches.
- Consider a WAF rule or temporary restriction on administrative and entity routes if you cannot patch right away.