Drupal Commerce Core access bypass under active exploit
Drupal published advisory SA-CONTRIB-2026-254 on October 28 for a highly critical access bypass in Commerce Core, the module that powers Drupal-based online shops. The flaw, CVE-2026-118539, scores 21 out of 25 on Drupal's risk scale and requires no authentication to exploit. Attackers are already using it in the wild.
The module fails to protect certain routes and entity fields, allowing unauthorized access that can financially harm the vendor. Affected versions include all Commerce Core releases below 2.41 and versions 3.0.0 through 3.3.12. If you run a Drupal shop, you are likely exposed.
Upgrade immediately to Commerce Core 8.x-2.41 if you are on version 2.x, or to 3.3.13 if you are on version 3.x. After patching, audit your order history for inconsistencies. The advisory notes that exploitation is ongoing, so speed matters.
If you need help assessing your Drupal estate, planning the upgrade, or reviewing order logs for signs of tampering, we can walk through it with you.