Attackers are actively exploiting a “highly critical” Drupal Commerce vulnerability, an access-bypass flaw in Commerce Core, the contributed module that runs shopping carts and checkout on many Drupal websites. Drupal’s security team published the advisory on October 28, 2026, but broader coverage did not arrive until October 30. Store owners running an affected version should patch now, then check their order records for changes they did not make.
What Drupal says is happening
Drupal’s advisory, SA-CONTRIB-2026-254, rates the flaw 21 out of 25 and labels it highly critical. The bug is an access bypass. Drupal says the module does not adequately protect certain routes and entity fields, which may financially harm the merchant.
The advisory is direct about the threat. “This vulnerability is being actively exploited in the wild,” the Drupal Security Team wrote. Drupal has not described the attack method, identified the attackers or said how many sites were targeted. SecurityWeek and The Hacker News also reported the exploitation.
The CVE record, CVE-2026-118539, was published on October 30 by Drupal acting as a CVE Numbering Authority. It classifies the flaw as missing authorization, tracked as CWE-862. One NVD mirror showed no NVD score as of October 30, so the severity picture may still change.
Which Drupal Commerce versions are affected
The vulnerable range covers Commerce Core below 2.41 and 3.0.0 through 3.3.13. The fixes are 3.3.13 for the 3.x branch and 8.x-2.41 for earlier branches.
| Branch | Vulnerable versions | Fixed in |
|---|---|---|
| 3.x | 3.0.0 through 3.3.13 | 3.3.13 |
| Earlier branches | Below 2.41 | 8.x-2.41 |
The same releases also fix five lower-rated Commerce Core advisories, SA-CONTRIB-2026-255 through SA-CONTRIB-2026-259. Teams should review those advisories while they upgrade, since the fixes ship together.
Drupal 7 sites fall outside this advisory. ITdaily reports 11,955 sites running Commerce 1.x, and Drupal 7 has had no security updates since January 5, 2025. Owners of those stores should plan to retire or migrate them.
Drupal Commerce patch and order audit steps
Drupal’s guidance comes down to two jobs: patch, then audit. A practical sequence looks like this:
- Confirm the installed Commerce Core version on every site, including staging copies that hold live customer data.
- Upgrade to 3.3.13 on the 3.x branch, or to 8.x-2.41 on earlier branches.
- Audit orders and customer records for inconsistencies, as Drupal advises. Look for totals, line items, prices or status changes that do not match your payment processor’s records.
- Review SA-CONTRIB-2026-255 through SA-CONTRIB-2026-259, which were fixed in the same releases.
- Retire any Drupal 7 Commerce sites that no longer receive updates.
Robert Coles, senior manager of threat intelligence security at Black Duck, gave the same sequence to SC World. “Patch it now, then go back and validate what happened before the fix was applied,” he said. He added, “If you’re running an affected version of Drupal Commerce, I wouldn’t treat this as just a patching exercise.”
Comparing order records against payment processor reports is a practical cross-check. A mismatch there is more useful evidence than a clean-looking admin screen.
Why a Drupal core update will not close the gap
This is the detail most likely to catch owners off guard. Commerce Core is a contributed module, separate from Drupal core security releases, so updating core does not patch it. Brandefense makes the same point in its advisory coverage. A store can run fully patched core and still be exposed.
The risk does not end with this one bug. Rescana reports that one related Commerce advisory lacks any workaround that replaces the upgrade. SecurityWeek reports that Drupal’s ratings indicate proofs of concept exist for two information-disclosure bugs, one in Commerce Core and one in Media Alias Display.
Earlier coverage also mentions a separate critical Drupal remote-code-execution flaw. Cryptika describes it, and it is a different issue from CVE-2026-118539. Readers and site owners should not confuse the two.
How many stores and shoppers are exposed
SecurityWeek reports that more than 42,000 sites use the module, citing Drupal statistics. ITdaily puts the number of websites running a vulnerable version above 30,000, and says 42,002 sites reported using Commerce Core as of October 18. Those figures measure different things, and neither has been confirmed as currently exposed.
Drupal Commerce is used by Fortune 500 companies and research universities, according to an iCounter executive quoted by SC World. Scale matters here because a single unpatched store on a large platform can still hold thousands of customer orders.
For shoppers, the risk is mostly indirect. A successful bypass could let unauthenticated users alter orders or other store data, which could lead to unauthorized order changes or payment disputes. Shoppers cannot see a store’s Drupal version, so the practical step is to watch for order confirmations or charges they did not request and contact the merchant. That advice is our inference, not a recommendation from Drupal.
For a comparable case where a login bypass demanded immediate patching, see our coverage of the critical Veeam Backup & Replication flaw.
What is still unknown
Several questions remain open, and Drupal has answered none of them publicly.
- Who is exploiting the flaw and how the attacks work.
- Whether attackers used the bug as a zero-day before patches shipped.
- Whether CISA’s Known Exploited Vulnerabilities catalog lists it. One vendor source says it was not listed as of the October 29 version, but that is a single source, and USA 24 could not confirm a KEV listing.
- Whether the “$0.01 purchase” claim seen in some coverage reflects real exploitation. Cryptika flags that claim as unverified, and Drupal has not confirmed it.
- The exact number of exposed sites, which differs by source.
What to watch next
Three signals will matter over the coming days. The first is whether Drupal updates the advisory with attack details, a count of affected sites or attribution. The second is whether NVD posts a score and whether CISA adds the CVE to its KEV catalog. The third is whether the proofs of concept for the information-disclosure bugs spread beyond researchers.
For another recent case where CISA added flaws to its KEV catalog, see our coverage of the Ivanti Connect Secure flaws. Store owners should recheck the Drupal advisory before closing their tickets, because the guidance may change as investigators learn more.
