Drupal Commerce Core Bypass Exploited, Patch 3.3.13

Drupal says attackers are exploiting CVE-2026-118539, a “highly critical” access bypass in the Commerce Core module, and wants store owners to patch and then check their orders. This is the one to move on if you run a Drupal storefront.

What to do

• Update now. Sites on the 3.x branch should go to Commerce Core 3.3.13. Earlier sites should go to 8.x-2.41. Both fixed versions are named in Drupal’s advisory, as relayed by BleepingComputer and The Hacker News.
• Audit orders. Drupal’s advisory says sites “should audit their orders for inconsistencies.” Look for orders that don’t match payments, totals or fulfilment you expect. Patching does not undo anything that already happened.
• Don’t wait on a severity score. The Hacker News lists no CVSS score for this CVE. Drupal’s own rating is 21 out of 25 on its risk scale, and SecurityWeek reports that unauthenticated attackers can exploit it however the module is configured.

What we know

The flaw is a missing authorization weakness. Per the advisory, the module “doesn’t sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor.” BleepingComputer lists affected versions as Commerce Core 0.0.0 through 2.41 and 3.0.0 through 3.3.13. SecurityWeek describes the range as 3.x before 3.3.13 and earlier releases before 8.x-2.41. Check your installed version against the advisory rather than trusting either summary.

The module is used on more than 42,000 sites, according to Drupal’s statistics.

What we don’t know

Drupal has confirmed exploitation but has not said how the bug is being abused, who is behind it, or how many sites were hit. It has also not said whether this was a zero-day before the patch shipped. We are not going to guess at the mechanics. The advisory is the place for detail.

The rest of the October 28 batch

Drupal published 38 other advisories the same day, covering 21 contributed projects, per SecurityWeek. Nearly a dozen are rated critical, including bugs that could lead to remote code execution, account takeover, or Commerce orders paid through Stripe being marked as paid without payment. If you run contributed modules, run your update check across all of them, not only Commerce Core.

SecurityWeek also notes the CAPTCHA module fix, where Drupal’s rating indicates exploit code exists, though the advisory does not mention active exploitation.

Priority call

1. Commerce Core on a live store: patch today, then audit orders.
2. Other critical contributed-module advisories from October 28: patch this week.
3. The October 14 core RCE fixes (CVE-2026-108097 in Field UI and CVE-2026-108099 in Entity List): if you haven’t applied them, do. Neither component is exposed on its own, but other modules or custom code can make them reachable. SecurityWeek says there are no public reports of exploitation so far. Our earlier coverage covers the details.

Drupal has history here. In May it warned of exploitation of CVE-2026-9082, a SQL injection in core’s database abstraction API, which CISA added to KEV days later. BleepingComputer counts five Drupal flaws CISA has flagged as exploited over the last several years. As of this writing we have not seen CVE-2026-118539 in the sources we reviewed as a KEV listing.

More in our Drupal hub.