Drupal Commerce Core: critical access bypass exploited

On Wednesday 28 October 2026 the Drupal security team published an advisory rated “highly critical” for Commerce Core, the module that adds online store features to a Drupal site: catalogue, shopping cart, checkout and APIs for decoupled applications. The vulnerability, tracked as CVE-2026-118539, is an access bypass that, according to the advisory itself, is already being exploited in the wild. BleepingComputer, The Hacker News and SecurityWeek reported on it.

Commerce Core is a community-developed module and, according to Drupal’s statistics as reported by BleepingComputer and SecurityWeek, it is used by more than 42,000 sites.

What we know

• CVE: CVE-2026-118539. BleepingComputer describes it as a missing authorization weakness.
• Cause: according to Drupal’s advisory, quoted by both outlets, the module does not sufficiently protect certain routes and entity fields. The result is unauthorised access that may have a financial impact on the vendor.
• Severity: Drupal risk score 21 out of 25 (reported by SecurityWeek). According to this score, the flaw can be exploited by unauthenticated attackers, regardless of how the module is configured.
• Exploitation: confirmed by Drupal. According to SecurityWeek, however, Drupal has not said how the flaw is being exploited, who is behind the attacks, how many sites have been hit, or whether it was exploited as a zero-day, before patches were available.
• Indicators of compromise: none reported by the sources.

Affected and fixed versions

The two outlets agree on the versions to install:

• 3.x branch: Commerce Core 3.3.13;
• earlier branch (2.x for Drupal 8 and later): Commerce Core 8.x-2.41.

SecurityWeek lists as vulnerable the 3.x versions before 3.3.13 and the earlier branch before 8.x-2.41. BleepingComputer instead writes that versions “0.0.0 through 2.41 and 3.0.0 through 3.3.13” are affected, a wording that also includes the numbers of the fixed releases. Drupal’s advisory is authoritative: if in doubt, check the installed version directly against the project page.

Where the attack fits

The sources do not describe the attack chain. From the advisory’s description we only know that an anonymous user can reach Commerce routes or change entity fields that should be protected, and that the impact on the vendor is financial: this is why Drupal asks sites to audit their orders for inconsistencies. In the MITRE ATT&CK framework the scenario falls under exploitation of an internet-facing application (T1190, Exploit Public-Facing Application).

The context: more Drupal advisories

According to SecurityWeek, on the same 28 October Drupal published 38 other advisories covering 21 contributed projects. Nearly a dozen are critical, including flaws that can lead to remote code execution, account takeover and Commerce orders paid via Stripe being marked as paid without payment. The CAPTCHA module received a fix for a moderately critical bug that allows a protected form to be submitted again without solving a new challenge; Drupal’s rating indicates that exploit code exists, but the advisory does not mention exploitation. Again according to SecurityWeek, proofs of concept exist for two information disclosure bugs, one in Commerce Core itself and one in Media Alias Display.

On 14 October Drupal had already fixed two critical remote code execution vulnerabilities, CVE-2026-108097 (core Field UI module) and CVE-2026-108099 (Entity List module). According to SecurityWeek they cannot be exploited on their own, but become exploitable with certain contributed modules or custom code, in some cases without authentication; so far there are no public reports of attacks. In May, by contrast, CVE-2026-9082 was exploited: an SQL injection in the core database abstraction API which, according to SecurityWeek, affects PostgreSQL-backed sites; according to BleepingComputer, CISA added it to the KEV catalogue a few days later, giving federal agencies three days to patch. BleepingComputer also notes that over the last several years CISA has flagged 5 exploited Drupal vulnerabilities, two of which were used by ransomware gangs.

Why it matters for European and Italian organisations

Drupal is widespread in public administrations, universities and companies, and Commerce Core is the foundation of many online stores and sales portals, often run by external agencies. Access that alters orders or Commerce entity fields can turn into direct financial losses: goods shipped without payment, altered prices or order states.

The sources do not say whether the attack also exposes customers’ personal data. If the order audit reveals access to personal data, GDPR obligations apply, including notification to the supervisory authority within 72 hours when there are risks to individuals. For online marketplaces and other entities within the scope of NIS2, handling of the vulnerability should be documented and any significant incident assessed for notification to the national CSIRT (in Italy, CSIRT Italia at ACN).

What to do now

1. Take an inventory of Drupal sites running Commerce Core, including test sites and those managed by agencies or providers, with the exact module version.
2. Update to Commerce Core 3.3.13 or 8.x-2.41 (with Composer the package is drupal/commerce), then clear caches and check that the site works.
3. Audit your orders, as Drupal asks: compare totals, prices and states with the payments actually received by your payment provider, and look for orders completed or changed without a matching payment.
4. Review web server logs for anomalous requests to Commerce routes and APIs from unauthenticated users.
5. Read the other 28 October advisories, especially the one on Stripe orders if you use that payment method, and also apply the 14 October core fixes.
6. Follow Drupal’s advisory: details on exploitation and indicators may arrive in the coming days.

How ARXDOME helps

ARX Expose shows your company’s public services and recognised products, useful for finding online stores exposed to the internet; ARX Radar shows who is attacking your perimeter right now. On servers with the agent, ARX Trace file changes tell you what changed and where, supporting your checks after the update.

Last updated: 30 October 2026