Drupal Commerce Core: Access Bypass Vulnerability (CVE-2026-118539)
An unauthenticated access bypass vulnerability in the Drupal Commerce Core module is being actively exploited in the wild, leading to potential financial impact on affected e-commerce platforms.
CVE search metadata
CVE search record: CVE-2026-118539. KEV: no. Product: Commerce Core (versions before 3.3.13), Commerce Core (versions before 8.x-2.41). Brief: Drupal Commerce Core: Access Bypass Vulnerability (CVE-2026-118539). Brief link: https://feed.craftedsignal.io/briefs/2026-10-drupal-commerce-bypass/
Triage facts
Revision 1- Applicability
- Commerce Core (versions before 3.3.13), Commerce Core (versions before 8.x-2.41)
- Evidence
- Unknown
- Severity
- Critical
- Action
- Immediate escalation
- Sources
- 1 public source
- Freshness
- Revision 1Oct 30, 11:41 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Very likely
Drupal has identified a highly critical access bypass vulnerability, tracked as CVE-2026-118539, affecting the Commerce Core module. The vulnerability allows unauthenticated attackers to exploit insufficient protection on specific routes and entity fields. The Drupal security team has assigned this issue a risk score of 21/25, noting that it is being actively exploited in the wild.
Impact
The vulnerability poses a direct financial risk to vendors using the affected module. Exploitation may allow attackers to manipulate commerce-related data, including the checkout process and order states. Drupal specifically urges administrators to audit store orders for inconsistencies.
Recommendation
- Upgrade the Drupal Commerce Core module to version 3.3.13 or 8.x-2.41 immediately.
- Review all commerce transactions and order logs for unauthorized changes, inconsistencies, or anomalies that occurred prior to patching.
- Audit Drupal instances for the presence of the vulnerable Commerce Core module versions if not already managed via centralized inventory.
Immediate actions
Patch Commerce Core to 3.3.13 or 8.x-2.41
Threat Hunt
Identify unauthorized changes or anomalies in commerce order state transitions
Data: Drupal database logs, Application audit logs, Order management system logs
Mitigations
Update Drupal Commerce Core to the latest patched version
CVE-2026-118539