Drupal Commerce Core Access Bypass Actively Exploited, Urges Immediate Patch for 42,000+ Stores
Drupal warns that a highly critical access bypass in its Commerce Core module is being exploited in the wild, affecting over 42,000 e-commerce sites.
Drupal announced on October 30, 2026 that a highly critical authorization bypass in its Commerce Core module (CVE-2026-118539) is currently being exploited by unauthenticated attackers. The flaw impacts versions 0.0.0-2.41 and 3.0.0-3.3.13, and the open-source project urges administrators of the more than 42,000 sites that rely on the module to upgrade immediately and audit order data for irregularities.
- Unauthenticated attackers can bypass access controls and manipulate commerce routes and entity fields.
- Drupal rates the vulnerability as “highly critical” with a risk score of 21 out of 25.
- Immediate updates to Commerce Core 3.3.13 (or 8.x-2.41 for earlier branches) are required, followed by order-integrity reviews.
What the vulnerability does
The advisory describes the issue as a missing authorization check that allows attackers to reach protected routes and entity fields without valid credentials. Because the module handles shopping carts, checkout forms, and API-driven sales, an exploit can let threat actors view, modify, or create orders, potentially causing financial loss for merchants.
Scope of affected installations
Drupal’s own statistics show the Commerce Core module powers more than 42,000 websites, ranging from small boutique shops to high-profile Fortune 500 enterprises and research universities. The vulnerability spans all 3.x releases prior to 3.3.13 and earlier 8.x-2.x releases before 8.x-2.41. Drupal’s security team assigned a CVSS-like risk score of 21/25, indicating that the flaw can be exploited regardless of configuration.
Evidence of active exploitation
Both SecurityWeek and BleepingComputer report that attacks are already underway, though neither source provides details on the attackers’ identity or the number of compromised sites. The advisory explicitly advises site owners to “audit their orders for inconsistencies,” implying that malicious order manipulation has been observed in the wild.
Response from the Drupal community
Drupal released fixed versions on October 28, 2026: Commerce Core 3.3.13 for the 3.x branch and 8.x-2.41 for earlier releases. The project also credited three independent researchers—Dan Puccetti, Marcus Johansson, and Robert Snyder—for reporting the flaw. In addition to the Commerce Core patch, Drupal published 38 other advisories on the same day, many of which address critical remote-code-execution and information-disclosure bugs.
Implications for website owners and developers
For e-commerce operators, the immediate priority is to apply the security updates and verify that no unauthorized orders have been placed or altered. Developers should also review custom code that interacts with Commerce Core routes, ensuring that any additional access checks are in place. Because the vulnerability can be exploited without authentication, traditional perimeter defenses may not detect the activity until order anomalies surface.
Regulatory and broader security context
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog, mandating that federal agencies patch within three days. This mirrors earlier CISA actions on Drupal’s May-2026 SQL-injection bug (CVE-2026-9082) and underscores the agency’s heightened focus on open-source CMS risks. The Commerce Core exploit joins a recent wave of high-profile vulnerabilities, including two critical PHP remote-code-execution bugs (CVE-2026-109618 and CVE-2026-109619) that are also seeing active exploitation.
What comes next
Drupal advises administrators to monitor order logs for unexpected status changes, such as payments marked as completed without corresponding transactions. Security teams should also enable Web Application Firewalls (WAFs) that can block anomalous requests to Commerce Core endpoints. Finally, organizations are encouraged to adopt a regular patch-management cadence, as Drupal’s October 2026 advisory cycle demonstrated that multiple critical issues can emerge simultaneously.
