In this article
Vulnerability summary
- CVE
- CVE-2026-118539
- Exploited?
- Yes, according to Drupal's security team: "This vulnerability is being actively exploited in the wild." At our check, CISA's Known Exploited Vulnerabilities catalog (version 2026.10.29) didn't list it yet.
Who is affected and what fixes it
| Product | Affected | Fixed in | Source |
|---|---|---|---|
| Drupal Commerce Core (commerce) 3.x | 3.0.0 up to, but not including, 3.3.13 | 3.3.13 | Drupal SA-CONTRIB-2026-254, checked |
| Drupal Commerce Core (commerce) 8.x-2.x and earlier | Versions before 8.x-2.41 | 8.x-2.41 | Drupal SA-CONTRIB-2026-254, checked |
Patch checklist
- Check your Commerce Core version (
composer show drupal/commerce, or Reports › Available updates in the Drupal admin). - Drupal's advice: on 3.x, update to Commerce Core 3.3.13 (
composer update drupal/commerce --with-dependencies, thendrush updbanddrush cr). On an earlier version, update to 8.x-2.41. - Drupal's advice: audit your orders for inconsistencies, because the flaw is being exploited.
- If an agency or host runs your store, ask them to confirm the update is installed and the order audit is done.
If you can't update yet
- Our advice: Drupal gives no workaround, so treat this as urgent. If you can't update today, consider putting the store in maintenance mode until you can, and watch new orders closely.
How to check for compromise
- Our advice: compare recent orders with your payment provider's records. Look for orders marked paid or completed without a matching payment, changed totals or prices, unexpected discounts, and orders edited by accounts that shouldn't have access.
TL;DR: Drupal’s security team says attackers are exploiting CVE-2026-118539, an access bypass in Drupal Commerce Core, the module that runs carts and checkout on many Drupal stores. It’s rated Highly critical (21 out of 25). Every 3.x release before 3.3.13 and every older release before 8.x-2.41 is affected. Both fixes came out on October 28, 2026. If you sell on Drupal, update today and check your recent orders.
What happened
On October 28, 2026, Drupal published security advisory SA-CONTRIB-2026-254 for Commerce Core. Drupal says the module “doesn’t sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor,” and adds: “This vulnerability is being actively exploited in the wild.”
Drupal’s risk score is 21 out of 25 (“Highly critical”). The score says no special setup or login is needed, all sites with the module are exposed, and an exploit exists. The affected range is versions before 2.41, and 3.0.0 up to but not including 3.3.13. Some early reports described the range as “3.0.0 to 3.3.13”, but 3.3.13 is the fix, not an affected version.
Drupal.org’s release feed shows Commerce Core 3.3.13 and 8.x-2.41 went out on October 28, 2026, between 15:42 and 15:54 UTC (11:42 to 11:54 p.m. Manila). The last 8.x-2 release before that was 8.x-2.40, from August 2024. Drupal hasn’t published technical details, and at our check CISA hadn’t added the CVE to its Known Exploited Vulnerabilities catalog.
The same day, Drupal published several more advisories for Commerce add-on modules, including SA-CONTRIB-2026-263 for Commerce Stripe (CVE-2026-118558, rated Critical). It’s a cross-site request forgery flaw in Commerce Stripe 2.0.0 up to, but not including, 2.2.3: an attacker who tricks an admin into clicking a link can get an order marked paid without payment. The fix is 2.2.3. Drupal doesn’t say that one is exploited. If you use Commerce add-ons, check the full advisory list too.
Why it matters
Our read: Drupal doesn’t say exactly what attackers can do, but “may financially impact the vendor” plus “audit their orders” points to tampering with orders or prices, not just reading data. For a small shop, that can mean shipping goods nobody paid for. It’s the second exploited store platform flaw we’ve covered this week, after Adobe Commerce and Magento CVE-2026-48356.
What to do now
- Find your version. Run
composer show drupal/commerce, or open Reports › Available updates in the Drupal admin. - Update. On 3.x, install 3.3.13. On anything older, install 8.x-2.41. With Composer:
composer update drupal/commerce --with-dependencies, thendrush updbanddrush cr. - Audit your orders, as Drupal advises. Compare orders from the past few weeks with your payment provider’s records. Look for orders marked paid without a matching payment, changed totals, odd discounts, and edits by unexpected accounts.
- Update your Commerce add-ons, such as Commerce Stripe (update to 2.2.3 if you’re on 2.x) and any others the October 28 advisories list.
Our tip: if an agency or host runs your store, send them the advisory link today and ask for two confirmations: the version now installed, and that the order check is done. For more patch guides, see our security hub.
Sources & method
| Source | What it confirms | Link |
|---|---|---|
| Drupal SA-CONTRIB-2026-254 (Oct 28, 2026) | CVE ID, Highly critical 21/25, access bypass, affected range, fixes 3.3.13 and 8.x-2.41, active exploitation, the order-audit advice | Drupal |
| Commerce Core 3.3.13 release | Released Oct 28, 2026 | Drupal |
| Commerce Core 8.x-2.41 release | Released Oct 28, 2026 | Drupal |
| Drupal contributed-project advisories | Other Commerce add-on advisories from Oct 28, including SA-CONTRIB-2026-263 (Commerce Stripe) | Drupal |
| Drupal SA-CONTRIB-2026-263 (Oct 28, 2026) | Commerce Stripe CVE-2026-118558, Critical 15/25, 2.0.0 to before 2.2.3, fix 2.2.3 | Drupal |
| CISA KEV (version 2026.10.29) | CVE-2026-118539 not listed at our check | CISA |
| The Hacker News (Oct 30, 2026) | Independent coverage | The Hacker News |
Last checked: Oct 30, 2026, 7:00 p.m. Manila (UTC+8). Method: We read Drupal’s advisory, checked release dates in Drupal.org’s update feed and checked CISA’s KEV catalog. Steps marked “Our advice”, tips marked “Our tip” and analysis marked “Our read” are ours, not Drupal’s. The thumbnail is an original OneSignalDesk card summarising Drupal’s advisory. No affiliate links. How we work.
Updates
- Oct 30, 2026, 9:00 p.m. Manila: First published. Drupal hasn’t released technical details. We’ll add a dated note if it does, or if CISA adds the CVE to its catalog.
Spotted an error? See our corrections policy and tell us.
