---
title: "Drupal Commerce Access Bypass Actively Exploited: Patch and Audit"
description: "Drupal confirms active exploitation of a Commerce Core access bypass. Fixed releases, the order audit, and the governance lesson."
url: https://policycortex.com/blog/drupal-commerce-access-bypass-actively-exploited
sealed: 2026-11-01
register: blog/drupal-commerce-access-bypass-actively-exploited
records: 3
digest: sha3:f2978e69dc3a2def50d3b36f17e2a1ab2248adc724a88d904d5d1da2da95df52
---

# Drupal Commerce Access Bypass Is Actively Exploited

Resources / Blog

Drupal warns that attackers are already using an access bypass flaw in Commerce Core. Patch to the fixed release and audit orders for tampering.

Leonard Esere · Sealed 2026-11-01 · Reading time 5 min

Filed under: [Drupal](https://policycortex.com/blog/tags/drupal), [Commerce Core](https://policycortex.com/blog/tags/commerce-core), [access control](https://policycortex.com/blog/tags/access-control), [flaw remediation](https://policycortex.com/blog/tags/flaw-remediation), [order audit](https://policycortex.com/blog/tags/order-audit)

**Summary**

- Drupal confirms attackers are using a Commerce Core access bypass.
- The fixed releases are Commerce Core 3.3.13 and 8.x-2.41.
- Patching alone is not enough. Audit orders for inconsistencies.
- Drupal rates it Highly critical on its own scale.

## What Drupal warned

Drupal published advisory SA-CONTRIB-2026-254 on October 28, 2026. The advisory rates the flaw Highly critical. Commerce Core lets a site sell goods and services online. It runs the cart and the checkout form. It also serves connected shopping apps. The module does not protect some routes and entity fields well enough. That gap leads to an access bypass. The bypass may financially impact the vendor. Drupal states plainly that attackers are using it now. Its words are 'actively exploited in the wild'. Drupal also tells sites to audit orders for inconsistencies.

## The flaw in plain words

The record is [CVE-2026-118539](https://www.cve.org/CVERecord?id=CVE-2026-118539). Common Vulnerabilities and Exposures (CVE) is the record system for public flaws. Missing authorization is the weakness type. An attacker without a login can reach protected routes and fields. That reach can change order data that belongs to a vendor. Versions before 8.x-2.41 on the older line are affected. Versions 3.0.0 through 3.3.12 on the 3.x line are affected. The fixed releases are 8.x-2.41 and 3.3.13. Drupal rates the flaw Highly critical on its own scale. It reports 21 out of 25 on that scale. No score on the Common Vulnerability Scoring System (CVSS) scale was assigned. BleepingComputer reports the module runs on more than 42,000 websites.

## What is not confirmed

The advisory names no attacker. It gives no victim count and no attack volume. It does not claim remote code execution. Remote code execution means running attacker code on the server. It does not claim a full site takeover. The Cybersecurity and Infrastructure Security Agency (CISA) runs the Known Exploited Vulnerabilities (KEV) Catalog. CISA has not listed this flaw there as of November 1, 2026. Do not cite a KEV listing for this flaw. Some reports mention penny pricing on tampered orders. Drupal does not confirm that detail in its advisory. Stick to what Drupal states.

## What to do

Upgrade 3.x sites to Commerce Core 3.3.13. Upgrade older sites to Commerce Core 8.x-2.41. Updating Drupal core alone does not fix the module. Then audit orders for inconsistencies. Look for price changes a vendor did not approve. Look for coupon and promotion links a vendor did not create. Look for orders that skipped payment steps. Keep the audit result with the patch record. A patch note with no audit result leaves a gap.

## The governance lesson

Access control is a claim an assessor will test. A setting that looks closed is not proof it holds. This flaw shows the gap between a setting and enforcement. Order records are the detection evidence here. They show what changed, and when it changed. Record the advisory date, the fixed release, and the patch date. Record the audit result beside the patch note. PolicyCortex does not patch Drupal modules. PolicyCortex helps teams link proof to requirements.

## Sources

- [CVE-2026-118539](https://www.cve.org/CVERecord?id=CVE-2026-118539) record, CVE Program
- Drupal security advisory SA-CONTRIB-2026-254, October 28, 2026. https://www.drupal.org/sa-contrib-2026-254
- BleepingComputer, Drupal warns of critical Commerce Core flaw exploited in attacks, October 30, 2026. https://www.bleepingcomputer.com/news/security/drupal-warns-of-critical-commerce-core-flaw-exploited-in-attacks/
- The Hacker News, Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw, October 30, 2026. http://thehackernews.com/2026/10/hackers-actively-exploit-highly.html
- Ostorlab, Drupal Commerce Access Bypass, Exploited in the Wild, October 30, 2026. https://blog.ostorlab.co/drupal-commerce-access-bypass-cve-2026-118539.html
- CISA Known Exploited Vulnerabilities Catalog, checked November 1, 2026. https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- Original diagram by PolicyCortex

## Next step

Want access control evidence linked to each requirement? See how [PolicyCortex](https://policycortex.com) collects it from live systems.

**Questions on this record**

**Q: Which releases fix the flaw?**
A: Use Commerce Core 3.3.13 on the 3.x line, or 8.x-2.41 on the older line.

**Q: Is this flaw on the exploited list?**
A: No. The Cybersecurity and Infrastructure Security Agency has not listed it as of November 1, 2026.

**Q: What should teams audit after patching?**
A: Audit orders for inconsistencies, including price and coupon changes.

**Q: Does the advisory claim a site takeover?**
A: No. It claims an access bypass with possible financial impact.

## Related records

Guides and articles describe the work. The evidence that work produces is described in three proof pages and one architecture page.

- **proof.state**: [Proof of State](https://policycortex.com/proof/state). What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained.
- **proof.change**: [Proof of Change](https://policycortex.com/proof/change). Who or what altered the environment, under what authority, with before and after state hashes.
- **proof.agency**: [Proof of Agency](https://policycortex.com/proof/agency). What a machine was permitted to do before it acted, what it did, and what would have stopped it.
- **architecture**: [Architecture](https://policycortex.com/architecture). How the chain is built and where it lives: inside your tenant, with no egress of evidence.

### Further reading in this register

| Published | Entry | Reading |
|---|---|---|
| 2026-10-31 | [Ivanti Gateway Chain Grows With Two New Exploited Flaws](https://policycortex.com/blog/ivanti-kev-chain-second-stage-october-2026): CISA added two more Ivanti Connect Secure flaws to its exploited list on October 30, 2026. Together with an earlier flaw, they form a chain attackers already used. | 5 min |
| 2026-10-31 | [Linux Kernel TCP Flaw Scores 9.8, With a Scoring Dispute](https://policycortex.com/blog/linux-kernel-tcp-98432-remote-root): A Linux kernel network flaw scored 9.8, but Red Hat rates it 5.9. The exploit needs a Multipath TCP listener, so check that detail first. | 5 min |
| 2026-10-30 | [Cisco Firewall Flaw Lets an Attacker Crash SSL VPN Devices](https://policycortex.com/blog/cisco-asa-ftd-ssl-vpn-kev-dos): Cisco patches an exploited denial of service flaw in ASA and FTD firewalls. CISA added it to its exploited list on October 29, 2026, with a November 1 due date. | 4 min |

Verify the record this entry describes. [Request Access](https://app.policycortex.com/auth?mode=request-access) · [Book a call](https://policycortex.com/book)

Dates of record

- **Published**: 2026-11-01
- **Last updated**: Unchanged since sealing
- **Author**: Leonard Esere
- **Record**: https://policycortex.com/blog/drupal-commerce-access-bypass-actively-exploited

## Register colophon

| Seq | Label | SHA3-256 | Prev |
|---|---|---|---|
| REC 0000 | HEAD | f14837294e05 | 5b010c592fa4 |
| REC 0001 | BODY | 552754aebf9f | f14837294e05 |
| REC 0002 | RELATED RECORDS | f2978e69dc3a | 552754aebf9f |

Head sha3:f2978e69dc3a2def50d3b36f17e2a1ab2248adc724a88d904d5d1da2da95df52. Each digest is SHA3-256 over the previous digest, the register key, the record label, and the record copy; a second party can recompute it from this document.