# Drupal Commerce Core Flaw CVE-2026-118539 Is Being Exploited, Patch Now

- URL: https://usa-24.com/drupal-commerce-vulnerability-exploited/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-31T05:36:49.463Z
- Updated: 2026-10-31T05:36:49.473Z
- Topics: Drupal, Cybersecurity, Vulnerabilities, Web Security, Ecommerce Security

> Attackers are exploiting a highly critical access-bypass flaw in Drupal Commerce Core, which runs checkout on many online stores. Drupal says merchants should patch and audit their orders now.

## Key takeaways

- Drupal rates CVE-2026-118539, tracked in advisory SA-CONTRIB-2026-254, 21 out of 25 and says it is being actively exploited in the wild.
- Commerce Core is vulnerable below 2.41 and from 3.0.0 through 3.3.13, and the fixes are 3.3.13 for the 3.x branch and 8.x-2.41 for earlier branches.
- Updating Drupal core does not patch Commerce Core, so store owners must upgrade the contributed module directly.
- Drupal advises store owners to audit orders and customer records for inconsistencies after patching.
- Drupal has not disclosed the attackers, the attack method or how many sites were targeted, and USA 24 could not confirm a CISA KEV listing.

Attackers are actively exploiting a “highly critical” Drupal Commerce vulnerability, an access-bypass flaw in Commerce Core, the contributed module that runs shopping carts and checkout on many Drupal websites. Drupal’s security team published the advisory on October 28, 2026, but broader coverage did not arrive until October 30. Store owners running an affected version should patch now, then check their order records for changes they did not make.

## What Drupal says is happening

Drupal’s advisory, [SA-CONTRIB-2026-254](https://www.drupal.org/sa-contrib-2026-254), rates the flaw 21 out of 25 and labels it highly critical. The bug is an access bypass. Drupal says the module does not adequately protect certain routes and entity fields, which may financially harm the merchant.

The advisory is direct about the threat. “This vulnerability is being actively exploited in the wild,” the Drupal Security Team wrote. Drupal has not described the attack method, identified the attackers or said how many sites were targeted. [SecurityWeek](https://www.securityweek.com/drupal-commerce-core-vulnerability-exploited-against-online-stores/) and [The Hacker News](https://thehackernews.com/2026/10/hackers-actively-exploit-highly.html) also reported the exploitation.

The CVE record, CVE-2026-118539, was published on October 30 by Drupal acting as a CVE Numbering Authority. It classifies the flaw as missing authorization, tracked as CWE-862. One [NVD mirror](https://vulners.com/nvd/NVD:CVE-2026-118539) showed no NVD score as of October 30, so the severity picture may still change.

## Which Drupal Commerce versions are affected

The vulnerable range covers Commerce Core below 2.41 and 3.0.0 through 3.3.13. The fixes are 3.3.13 for the 3.x branch and 8.x-2.41 for earlier branches.

| Branch | Vulnerable versions | Fixed in |
|---|---|---|
| 3.x | 3.0.0 through 3.3.13 | 3.3.13 |
| Earlier branches | Below 2.41 | 8.x-2.41 |

The same releases also fix five lower-rated Commerce Core advisories, SA-CONTRIB-2026-255 through SA-CONTRIB-2026-259. Teams should review those advisories while they upgrade, since the fixes ship together.

Drupal 7 sites fall outside this advisory. [ITdaily](https://itdaily.com/news/security/drupal-commerce-cve-2026-118539-access-flaw/) reports 11,955 sites running Commerce 1.x, and Drupal 7 has had no security updates since January 5, 2025. Owners of those stores should plan to retire or migrate them.

## Drupal Commerce patch and order audit steps

Drupal’s guidance comes down to two jobs: patch, then audit. A practical sequence looks like this:

- Confirm the installed Commerce Core version on every site, including staging copies that hold live customer data.
- Upgrade to 3.3.13 on the 3.x branch, or to 8.x-2.41 on earlier branches.
- Audit orders and customer records for inconsistencies, as Drupal advises. Look for totals, line items, prices or status changes that do not match your payment processor’s records.
- Review SA-CONTRIB-2026-255 through SA-CONTRIB-2026-259, which were fixed in the same releases.
- Retire any Drupal 7 Commerce sites that no longer receive updates.

Robert Coles, senior manager of threat intelligence security at Black Duck, gave the same sequence to [SC World](https://www.scworld.com/news/drupal-commerce-core-access-bypass-flaw-exploited-in-attacks). “Patch it now, then go back and validate what happened before the fix was applied,” he said. He added, “If you’re running an affected version of Drupal Commerce, I wouldn’t treat this as just a patching exercise.”

Comparing order records against payment processor reports is a practical cross-check. A mismatch there is more useful evidence than a clean-looking admin screen.

## Why a Drupal core update will not close the gap

This is the detail most likely to catch owners off guard. Commerce Core is a contributed module, separate from Drupal core security releases, so updating core does not patch it. [Brandefense](https://brandefense.io/security-news/drupal-commerce-core-access-bypass-active-exploitation/) makes the same point in its advisory coverage. A store can run fully patched core and still be exposed.

The risk does not end with this one bug. [Rescana](https://www.rescana.com/post/drupal-commerce-core-cve-2026-118539-access-bypass-exploited) reports that one related Commerce advisory lacks any workaround that replaces the upgrade. SecurityWeek reports that Drupal’s ratings indicate proofs of concept exist for two information-disclosure bugs, one in Commerce Core and one in Media Alias Display.

Earlier coverage also mentions a separate critical Drupal remote-code-execution flaw. [Cryptika](https://www.cryptika.com/critical-drupal-commerce-vulnerability-could-let-hackers-buy-products-for-just-0-01/) describes it, and it is a different issue from CVE-2026-118539. Readers and site owners should not confuse the two.

## How many stores and shoppers are exposed

SecurityWeek reports that more than 42,000 sites use the module, citing Drupal statistics. ITdaily puts the number of websites running a vulnerable version above 30,000, and says 42,002 sites reported using Commerce Core as of October 18. Those figures measure different things, and neither has been confirmed as currently exposed.

Drupal Commerce is used by Fortune 500 companies and research universities, according to an iCounter executive quoted by SC World. Scale matters here because a single unpatched store on a large platform can still hold thousands of customer orders.

For shoppers, the risk is mostly indirect. A successful bypass could let unauthenticated users alter orders or other store data, which could lead to unauthorized order changes or payment disputes. Shoppers cannot see a store’s Drupal version, so the practical step is to watch for order confirmations or charges they did not request and contact the merchant. That advice is our inference, not a recommendation from Drupal.

For a comparable case where a login bypass demanded immediate patching, see our coverage of the [critical Veeam Backup & Replication flaw](https://usa-24.com/veeam-backup-replication-vulnerability-patch/).

## What is still unknown

Several questions remain open, and Drupal has answered none of them publicly.

- Who is exploiting the flaw and how the attacks work.
- Whether attackers used the bug as a zero-day before patches shipped.
- Whether CISA’s Known Exploited Vulnerabilities catalog lists it. One vendor source says it was not listed as of the October 29 version, but that is a single source, and USA 24 could not confirm a KEV listing.
- Whether the “$0.01 purchase” claim seen in some coverage reflects real exploitation. Cryptika flags that claim as unverified, and Drupal has not confirmed it.
- The exact number of exposed sites, which differs by source.

## What to watch next

Three signals will matter over the coming days. The first is whether Drupal updates the advisory with attack details, a count of affected sites or attribution. The second is whether NVD posts a score and whether CISA adds the CVE to its KEV catalog. The third is whether the proofs of concept for the information-disclosure bugs spread beyond researchers.

For another recent case where CISA added flaws to its KEV catalog, see our coverage of the [Ivanti Connect Secure flaws](https://usa-24.com/ivanti-connect-secure-vulnerability-cisa-kev/). Store owners should recheck the Drupal advisory before closing their tickets, because the guidance may change as investigators learn more.

## Frequently asked questions

### Is my Drupal store affected by CVE-2026-118539?

Stores running Commerce Core below 2.41, or versions from 3.0.0 through 3.3.13, are affected. Check the installed Commerce Core version on every site, including staging copies. If you run an affected version, upgrade right away and then audit your orders.

### Which Drupal Commerce version fixes CVE-2026-118539?

Version 3.3.13 fixes the 3.x branch, and 8.x-2.41 fixes earlier branches. Updating Drupal core alone does not fix the bug, because Commerce Core is a contributed module with its own security releases. Drupal 7 Commerce 1.x sites are not covered by this advisory and should be retired.

### Has the Drupal Commerce flaw been exploited?

Yes, according to Drupal, which states the vulnerability is being actively exploited in the wild. Drupal has not described the attack method, identified the attackers or said how many sites were targeted. A claim that the bug allows $0.01 purchases remains unverified.

### What should I do if my store may have been hit?

Drupal advises owners to audit orders and customer records for inconsistencies after patching. Compare order totals and status changes with your payment processor’s reports. Shoppers who see unexpected order confirmations or charges should contact the merchant.

## Sources

1. [Drupal Commerce Core Vulnerability Exploited Against Online Stores — SecurityWeek](https://www.securityweek.com/drupal-commerce-core-vulnerability-exploited-against-online-stores/)
2. [Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw — The Hacker News](https://thehackernews.com/2026/10/hackers-actively-exploit-highly.html)
3. [Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254 — Drupal.org](https://www.drupal.org/sa-contrib-2026-254)
4. [Drupal Commerce Core access bypass flaw exploited in attacks — SC Media/SC World](https://www.scworld.com/news/drupal-commerce-core-access-bypass-flaw-exploited-in-attacks)
5. [30,000 Drupal web shops potentially vulnerable to actively exploited access flaw — ITdaily](https://itdaily.com/news/security/drupal-commerce-cve-2026-118539-access-flaw/)
6. [Drupal Commerce Core CVE-2026-118539 Access Bypass Actively Exploited: Patch to 3.3.13 / 8.x-2.41 and Audit Orders — Rescana](https://www.rescana.com/post/drupal-commerce-core-cve-2026-118539-access-bypass-exploited)
7. [Drupal Commerce Core Access Bypass: Patch Now — Brandefense](https://brandefense.io/security-news/drupal-commerce-core-access-bypass-active-exploitation/)
8. [Critical Drupal Commerce Vulnerability Could Let Hackers Buy Products for Just $0.01 — Cryptika](https://www.cryptika.com/critical-drupal-commerce-vulnerability-could-let-hackers-buy-products-for-just-0-01/)
9. [CVE-2026-118539 — Vulners NVD mirror](https://vulners.com/nvd/NVD:CVE-2026-118539)