The Drupal Security Team says attackers are actively exploiting CVE-2026-118539, an access bypass flaw in Commerce Core that can affect Drupal-powered online stores. The advisory was published on October 28, 2026.
Commerce Core provides shopping cart, checkout, order-management, and API-driven commerce functionality for Drupal sites. That makes this vulnerability different from a generic website bug: the exposed area is tied directly to transactions.
Drupal’s advisory does not publish route names, exploit requests, attacker infrastructure, or other exploit indicators. Drupal has not named affected sites, attributed the activity to a specific actor, or stated how many stores may have been hit. The issue involves insufficient access controls around certain Commerce routes and entity fields, and the stated impact includes possible financial harm to the vendor.
The issue’s 21 out of 25 risk score falls within Drupal’s Highly critical range of 20 to 25. The advisory’s vector also lists no access complexity, no authentication requirement, some confidentiality impact, some integrity impact, known exploitation, and all module configurations affected.
Fraudulent order attempts were reported on live sites
Centarro, the maintainer of Drupal Commerce, published a follow-up on October 29 in consultation with the Drupal Security Team. The company said it received two reports from merchants who saw attempts by malicious users to place fraudulent orders using the vulnerability.
Centarro said it and the Drupal Security Team looked for broader abuse and, as of that post, did not believe the activity had been scripted or exploited beyond the initially reported sites. That is useful context, but it should not be treated as reassurance for unpatched stores. Drupal has still confirmed active exploitation, and the Canadian Centre for Cyber Security issued advisory AV26-1105 on October 30 encouraging users and administrators to review the Drupal guidance and apply necessary updates.
Fixed releases are available
Commerce Core versions earlier than 8.x-2.41 and 3.x releases earlier than 3.3.13 are affected; Drupal’s advisory names those two versions as the fixed security releases. As of November 4, a newer 3.x release, 3.3.14, has also been posted with additional bug fixes, so 3.x sites should be on 3.3.13 or later after normal compatibility testing.
The related release pages for 3.3.13 and 8.x-2.41 both list multiple Commerce Core security issues fixed on October 28. Centarro also said it packaged security releases for Commerce API, Commerce License, Commerce Shipping, and Commerce Stripe that users should update at the same time when those modules are present.
Order audits matter after the patch
Installing the fixed release closes the known vulnerability, but it does not prove that earlier orders were legitimate. Centarro recommends reviewing recent orders because the observed issue involved attempted order fraud on live sites.
The maintainer’s review guidance focuses on payment and pricing inconsistencies. Operators should look for placed orders that were not paid, paid-looking orders with no matching payment entities, suspicious product prices that do not match configured promotions, and unexpected discounts, fees, or adjustments. Centarro said reports included orders with obviously incorrect prices, such as $0.01, as well as orders placed at normal prices.
Centarro also cautioned that some results can be legitimate, depending on how a store works. Staff-created orders, authorized-but-not-captured payments, custom checkout flows, donation products, and manual price overrides can all complicate the review. The strongest confirmation is to compare order IP addresses and timestamps against access logs and normal checkout paths.
Why the review window may be wider than expected
Centarro said exploitation was theoretically possible since Commerce Core 8.x-2.18, released May 26, 2020, when used with Drupal’s JSON:API module, and since 8.x-2.25, released June 30, 2021, for other sites.
That does not mean exploitation has been happening since those dates. Still, the age of the underlying exposure means each store’s audit window should be based on available logs, order volume, fulfillment risk, and the value of goods or services delivered through the site.
What affected sites should do now
Upgrade Commerce Core to 3.3.13 or later on the 3.x branch, or to 8.x-2.41 on the older branch.
Update related Commerce modules, including Commerce API, Commerce License, Commerce Shipping, and Commerce Stripe, when used.
Audit recent orders for mismatched payment records, unpaid placed orders, suspicious prices, unexpected adjustments, and unusual order paths.
Confirm payment before fulfillment, especially where digital goods, access licenses, shipments, or services may be delivered automatically.
Review JSON:API update access. Centarro recommends switching it back to read-only if update operations are not required.
Preserve relevant Drupal, web server, proxy, WAF, and payment-provider logs before normal retention windows remove useful evidence.
Get new small business insights by email
Practical ideas and useful articles to help you make better business decisions.
Tech Help Canada Staff researches, writes, and reviews practical content for business owners and professionals. Our coverage spans business, marketing, SEO, technology, and the tools and systems people use to grow and operate online. We focus on clear, useful information backed by research, hands-on experience, and editorial review. Learn more about our team and editorial standards. Need help with something? Contact Us
