Which releases fix the flaw?

Use Commerce Core 3.3.13 on the 3.x line, or 8.x-2.41 on the older line.

Is this flaw on the exploited list?

No. The Cybersecurity and Infrastructure Security Agency has not listed it as of November 1, 2026.

What should teams audit after patching?

Audit orders for inconsistencies, including price and coupon changes.

Does the advisory claim a site takeover?

No. It claims an access bypass with possible financial impact.

ResourcesBlog

Drupal Commerce Access Bypass Is Actively Exploited

Drupal warns that attackers are already using an access bypass flaw in Commerce Core. Patch to the fixed release and audit orders for tampering.

Leonard EserePublished 2026-11-01Reading time 5 min

Filed underDrupal Commerce Core access control flaw remediation order audit

Drupal Commerce Access Bypass Is Actively Exploited

Summary

Drupal confirms attackers are using a Commerce Core access bypass.
The fixed releases are Commerce Core 3.3.13 and 8.x-2.41.
Patching alone is not enough. Audit orders for inconsistencies.
Drupal rates it Highly critical on its own scale.

What Drupal warned

Drupal published advisory SA-CONTRIB-2026-254 on October 28, 2026. The advisory rates the flaw Highly critical. Commerce Core lets a site sell goods and services online. It runs the cart and the checkout form. It also serves connected shopping apps. The module does not protect some routes and entity fields well enough. That gap leads to an access bypass. The bypass may financially impact the vendor. Drupal states plainly that attackers are using it now. Its words are 'actively exploited in the wild'. Drupal also tells sites to audit orders for inconsistencies.

The flaw in plain words

The record is CVE-2026-118539. Common Vulnerabilities and Exposures (CVE) is the record system for public flaws. Missing authorization is the weakness type. An attacker without a login can reach protected routes and fields. That reach can change order data that belongs to a vendor. Versions before 8.x-2.41 on the older line are affected. Versions 3.0.0 through 3.3.12 on the 3.x line are affected. The fixed releases are 8.x-2.41 and 3.3.13. Drupal rates the flaw Highly critical on its own scale. It reports 21 out of 25 on that scale. No score on the Common Vulnerability Scoring System (CVSS) scale was assigned. BleepingComputer reports the module runs on more than 42,000 websites.

What is not confirmed

The advisory names no attacker. It gives no victim count and no attack volume. It does not claim remote code execution. Remote code execution means running attacker code on the server. It does not claim a full site takeover. The Cybersecurity and Infrastructure Security Agency (CISA) runs the Known Exploited Vulnerabilities (KEV) Catalog. CISA has not listed this flaw there as of November 1, 2026. Do not cite a KEV listing for this flaw. Some reports mention penny pricing on tampered orders. Drupal does not confirm that detail in its advisory. Stick to what Drupal states.

What to do

Upgrade 3.x sites to Commerce Core 3.3.13. Upgrade older sites to Commerce Core 8.x-2.41. Updating Drupal core alone does not fix the module. Then audit orders for inconsistencies. Look for price changes a vendor did not approve. Look for coupon and promotion links a vendor did not create. Look for orders that skipped payment steps. Keep the audit result with the patch record. A patch note with no audit result leaves a gap.

The governance lesson

Access control is a claim an assessor will test. A setting that looks closed is not proof it holds. This flaw shows the gap between a setting and enforcement. Order records are the detection evidence here. They show what changed, and when it changed. Record the advisory date, the fixed release, and the patch date. Record the audit result beside the patch note. PolicyCortex does not patch Drupal modules. PolicyCortex helps teams link proof to requirements.

Sources

CVE-2026-118539 record, CVE Program
Drupal security advisory SA-CONTRIB-2026-254, October 28, 2026. https://www.drupal.org/sa-contrib-2026-254
BleepingComputer, Drupal warns of critical Commerce Core flaw exploited in attacks, October 30, 2026. https://www.bleepingcomputer.com/news/security/drupal-warns-of-critical-commerce-core-flaw-exploited-in-attacks/
The Hacker News, Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw, October 30, 2026. http://thehackernews.com/2026/10/hackers-actively-exploit-highly.html
Ostorlab, Drupal Commerce Access Bypass, Exploited in the Wild, October 30, 2026. https://blog.ostorlab.co/drupal-commerce-access-bypass-cve-2026-118539.html
CISA Known Exploited Vulnerabilities Catalog, checked November 1, 2026. https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Original diagram by PolicyCortex

Next step

Want access control evidence linked to each requirement? See how PolicyCortex collects it from live systems.

Questions on this record

Which releases fix the flaw?: Use Commerce Core 3.3.13 on the 3.x line, or 8.x-2.41 on the older line.
Is this flaw on the exploited list?: No. The Cybersecurity and Infrastructure Security Agency has not listed it as of November 1, 2026.
What should teams audit after patching?: Audit orders for inconsistencies, including price and coupon changes.
Does the advisory claim a site takeover?: No. It claims an access bypass with possible financial impact.

Related records

Guides and articles describe the work. The evidence that work produces is described in three proof pages and one architecture page.

proof.state: Proof of State. What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained.
proof.change: Proof of Change. Who or what altered the environment, under what authority, with before and after state hashes.
proof.agency: Proof of Agency. What a machine was permitted to do before it acted, what it did, and what would have stopped it.
architecture: Architecture. How the chain is built and where it lives: inside your tenant, with no egress of evidence.