Actively Exploited Drupal Commerce Flaw Can Bypass Access Controls

Drupal has released urgent updates for a highly critical Commerce Core vulnerability that is already being exploited and could have a financial impact on affected online stores.

Drupal is warning administrators to urgently update Commerce Core after confirming that attackers are actively exploiting a highly critical access-control vulnerability affecting online stores.

The Drupal security advisory SA-CONTRIB-2026-254, published October 28, tracks the vulnerability as CVE-2026-118539 and assigns it a Drupal security risk score of 21 out of 25.

Commerce Core provides shopping cart, checkout and API capabilities for Drupal-based commerce sites. According to the Drupal Security Team, the module does not adequately protect certain routes and entity fields, creating an access bypass that could financially affect a merchant.

Drupal has not publicly detailed the full exploitation technique, which can help limit additional abuse while vulnerable installations remain online.

Attacks are already occurring

The security team explicitly said the vulnerability is being exploited in the wild, making patching more urgent than for a flaw disclosed only as a theoretical risk.

Commerce Core releases earlier than 2.41 are affected on the older branch. On the 3.x branch, versions from 3.0.0 through 3.3.12 are vulnerable.

Administrators running Commerce Core 3.x should upgrade to version 3.3.13. Sites using the earlier branch should move to Commerce Core 8.x-2.41.

Drupal also recommends reviewing orders for inconsistencies because exploitation could affect commerce-related data. That review is particularly important for internet-facing stores that remained on a vulnerable release after exploitation began.

The advisory does not indicate that the vulnerability affects Drupal core itself. The issue resides in the contributed Commerce Core project, meaning exposure depends on whether a site has installed an affected version of that module.

Because attacks have already been observed, administrators should treat the fixed releases as urgent security updates rather than waiting for a normal maintenance window.