CVE-2026-118539 Drupal Commerce: exploited access bypass

Call: Patch now. Drupal’s security team says CVE-2026-118539 in Commerce Core, the module that runs Drupal shopping carts and checkout, “is being actively exploited in the wild.” It rates it Highly critical (21 of 25). The fix shipped Oct 28.

What breaks: Drupal says the module “doesn’t sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor.” It doesn’t say more than that. Read “financially impact” as orders that don’t add up: prices, totals or payment states someone shouldn’t have been able to change.

Who’s hit: Any site running Commerce Core older than 8.x-2.41, or 3.x older than 3.3.13. BleepingComputer puts the module on more than 42,000 sites. It’s not in CISA’s KEV catalog yet.

What to do:

3.x: upgrade to Commerce Core 3.3.13.
2.x: upgrade to Commerce Core 8.x-2.41.
Same day, separate fixes: Drupal also patched Commerce Stripe (2.2.3, or 8.x-1.4 on 1.x), Commerce Shipping (3.0.6, or 8.x-2.16 on 2.x) and Commerce License (3.1.1) on Oct 28. Those are separate advisories (SA-CONTRIB-2026-260 to -265), not part of the fix for CVE-2026-118539. If you run them, update them too. Commerce API had no security release.
Then audit your orders. That’s Drupal’s own advice, because the flaw is already being used. Compare order totals against what your payment gateway actually captured, going back at least to early October.

Drupal lists no workaround.

Sources: Drupal SA-CONTRIB-2026-254 (opens in a new tab), SA-CONTRIB-2026-260 to -265 (opens in a new tab), BleepingComputer (opens in a new tab).

CVE-2026-118539 Drupal Commerce: exploited access bypass

Sources

More from October 2026 patch cycle