Drupal Commerce Core Vulnerability Exploited Against Online Stores

What it is

CVE-2026-118539 is an access bypass in the Drupal Commerce Core contributed module, which adds a shopping cart and checkout to Drupal sites. Drupal's statistics show more than 42,000 sites using it. Drupal confirmed active exploitation and rated the flaw 21 out of 25.

How it works

Drupal's advisory says the module "doesn't sufficiently protect certain routes and entity fields", which allows an access bypass that "may financially impact the vendor". The risk score means unauthenticated attackers can exploit it regardless of how the module is configured. Drupal has not said how the attacks work, who is behind them, or how many sites were hit. It also has not said whether the bug was exploited as a zero-day before patches existed.

Preconditions / Affected

Versions 3.x before 3.3.13 and earlier releases before 8.x-2.41 are affected. No special configuration or login is needed to exploit it.

What to do

Update to 3.3.13 or 8.x-2.41. Then audit store orders for inconsistencies, since the advisory states that "Sites should audit their orders for inconsistencies as this vulnerability is being actively exploited". Because the exploitation method is unpublished, order review is the only detection step the page offers.

Other advisories from the same period

• The 28 October 2026 batch has 38 advisories covering 21 contributed projects. Nearly a dozen are rated critical. These include bugs that could lead to remote code execution, account takeover, or Commerce orders paid through Stripe being marked as paid without payment. Stores using Stripe should check this batch separately from CVE-2026-118539.
• The CAPTCHA module has a moderately critical bug that lets a protected form be submitted again without solving a new challenge. Drupal's rating indicates exploit code exists in the wild, though the advisory does not mention active exploitation.
• Drupal's ratings indicate proofs of concept exist for two information disclosure bugs, one in Commerce Core and one in Media Alias Display.
• The 14 October 2026 releases fixed two critical RCE bugs: CVE-2026-108097 in core's Field UI module and CVE-2026-108099 in the Entity List module. Neither component exposes the flaw alone. Certain other contributed modules or custom code make it exploitable, in some cases without authentication. Drupal warned that exploits might appear within hours or days, but the page reports no public exploitation so far.
• CVE-2026-9082, a highly critical SQL injection in core's database abstraction API affecting PostgreSQL-backed sites, drew exploitation attempts in May 2026.

Caveats

The page does not describe the exploit technique, the attackers, or the scale of the attacks. It does not say which contributed modules make the 14 October RCE bugs reachable, so sites cannot rule themselves out from the page alone.