Drupal Commerce Bug Under Attack Could Cost Store Owners Money
Drupal says attackers are exploiting CVE-2026-118539, a 'Highly critical' access bypass in Commerce Core that can hit store owners financially. Fixed in 3.3.13 and 8.x-2.41; audit your orders.
Drupal’s security team says attackers are already exploiting an access bypass in Commerce Core, the module behind most Drupal online stores. The Oct. 28 advisory rates it “Highly critical” (21 out of 25) and warns the flaw could hurt store owners financially, The Hacker News reports. Fixed releases are out, and Drupal is telling shops to check their orders.
For defenders
The bug: CVE-2026-118539 (CWE-862, missing authorization). Drupal says Commerce Core doesn’t properly protect certain routes and entity fields, which lets someone reach things they shouldn’t. It hasn’t said which routes or fields, and no CVSS score has been published yet. The “financial impact on the vendor” wording points at orders, prices or payments rather than customer data, but Drupal hasn’t spelled that out.
Affected: Commerce Core below 8.x-2.41, and 3.0.0 up to (not including) 3.3.13.
Fixed: 3.3.13 for the 3.x branch, 8.x-2.41 for older sites. No workaround is listed.
Exploitation: KNOWN, per Drupal, which gives no detail on who is behind it, what they’re doing or how many stores are hit. No public exploit is reported. This is T1190 (Exploit Public-Facing Application). Credit goes to Dan Puccetti, Marcus Johansson and Robert Snyder.
After patching: Drupal’s own advice is to audit orders for inconsistencies. In practice that means comparing order totals, line-item prices, adjustments and payment states against what your payment gateway actually received, and reviewing web logs for unauthenticated or customer-level requests to Commerce admin and order routes.
What it means for you
If you run a shop on Drupal, someone may be able to tamper with parts of your store they shouldn’t touch, and Drupal’s wording suggests the damage lands on you as the seller, not your customers. Think orders that don’t add up. If you only buy from Drupal stores, there’s nothing for you to do. If a web agency runs your site, ask them today whether Commerce has been updated.
Do this now
- Update Commerce Core to 3.3.13 (or 8.x-2.41 on older sites) now.
- Compare recent orders against your payment provider’s records and look for prices, discounts or statuses that don’t match.
- If something looks off, keep the web server logs and talk to whoever hosts or builds your site before cleaning anything up.
CVE at a glance
- CVSS
- 6.5 Medium (v3.1)
- EPSS
- 0.2% chance of exploitation in the next 30 days (higher than 12.8% of CVEs)
- Exploited in the wild
- Not on CISA’s KEV list
- Public exploit
- None reported in public exploit databases
Data from NVD, FIRST EPSS and CISA KEV, refreshed automatically. We report whether public exploit code exists but never link to it: fake proof-of-concepts that infect researchers are common.