Drupal Commerce CVE-2026-118539: access bypass under active attack

Drupal's security team has flagged a flaw in Commerce Core — the module behind a large share of Drupal-based online stores — as "highly critical" and already under attack, and has deliberately withheld the technical detail that would let defenders write a detection rule. If you run a Drupal shop, the window to patch and check your orders is now, not after the weekend.

Developing story — first published 09:54 CET (08:54 UTC), October 30, 2026. Updated as the vendor and CISA publish more.

At a glance

CVE	CVE-2026-118539
Product / affected versions	Drupal Commerce Core (contrib module commerce) · all releases below 8.x-2.41; 3.0.0 through 3.3.12
Fixed in	8.x-2.41 (legacy 2.x branch) · 3.3.13 (3.x branch) · released 2026-10-28
CVSS	NVD not yet scored (status "Received", 2026-10-30) · Drupal rates it Highly critical, 21/25, vector AC:None · A:None · CI:Some · II:Some · E:Exploit · TD:All
Exploited in the wild	Yes · stated in Drupal advisory SA-CONTRIB-2026-254
CISA KEV	Not listed (catalog version 2026.10.29)
Public PoC	None named by sources as of 2026-10-30; Drupal's risk vector marks exploit code already deployed (E:Exploit)
Official advisory	SA-CONTRIB-2026-254

What happened

CVE-2026-118539 is a missing-authorization flaw (CWE-862) in Drupal Commerce Core, the open-source commerce layer that provides the cart, checkout, order and product entities for Drupal storefronts, including decoupled front-ends that talk to it over an API. Drupal's advisory SA-CONTRIB-2026-254, dated 2026-10-28, rates it Highly critical at 21 out of 25 and states plainly: "This vulnerability is being actively exploited in the wild."

The mechanism, in the advisory's words, is that "the module doesn't sufficiently protect certain routes and entity fields, leading to an access bypass." The NVD record, published 2026-10-30 and still unscored, gives the one-line technical class: the flaw "allows Forceful Browsing." Forceful browsing means an attacker reaches URLs, routes and entity fields by requesting them directly — the application never enforces the access check it should have. Drupal's risk vector spells out the consequence: AC:None (the attacker just visits a page), A:None (no authentication needed), CI:Some (certain non-public data is released), II:Some (some data can be modified).

In a commerce context, "some data can be modified" and "may financially impact the vendor" are not abstractions. Order totals, line-item prices, discount and coupon state, and fulfillment status are exactly the entity fields a cart module exposes, and they are exactly the fields a seller cannot afford an anonymous visitor to reach or rewrite. Drupal has not published which routes, which fields, or what the observed attacks do — only that they are happening and that stores should check their orders. The module reports roughly 42,000 active installs on its Drupal.org project page, according to securityonline.info.

"Sites should audit their orders for inconsistencies as this vulnerability is being actively exploited." — SA-CONTRIB-2026-254, the only detection guidance Drupal has given

That sentence is the whole problem. With no IOCs, no route names and no log signature, the vendor's own advice is a manual, after-the-fact order review. That catches the fraud you can already see; it does nothing for the access to non-public data that leaves no dent in an order total.

Who is exposed and how to check your version

You are affected if you run Commerce Core below 8.x-2.41 on the legacy 2.x branch, or any 3.x release before 3.3.13. Check the installed version before anything else:

# Composer-managed sites
composer show drupal/commerce | grep versions

# Drush, on any site
drush pm:list --type=module --status=enabled | grep -i commerce

# Or read it straight from the module metadata
grep -E '^version' web/modules/contrib/commerce/commerce.info.yml

If the version is below the fixed releases above, treat the site as exposed. The flaw needs no credentials and no special configuration — Drupal's vector marks TD:All, meaning every module configuration is exploitable.

Remediation

1. Am I affected? Run the version check above. Anything under 8.x-2.41 (2.x) or under 3.3.13 (3.x) is in scope, regardless of how the store is configured.

2. Patch — exact fixed versions. Install the latest release for your branch, verbatim from the advisory:

• 3.x branch → upgrade to Commerce Core 3.3.13 (composer require drupal/commerce:^3.3.13)
• Legacy 2.x branch → upgrade to Commerce Core 8.x-2.41 (composer require drupal/commerce:^2.41)

Run drush updatedb and clear caches (drush cr) after the package update so entity and route definitions are rebuilt.

3. Can't patch now? Compensating controls. These reduce exposure; they are not a substitute for the fix, because Drupal has not named the vulnerable routes, so no edge rule can be known-complete. Still, in order of value: put the storefront behind a WAF or reverse proxy and deny anonymous access to administrative and commerce API paths you do not serve publicly; review the permissions granted to the anonymous and authenticated roles for anything commerce-related and remove what is not required; if you expose Commerce over a decoupled/JSON:API surface you do not use, disable it. Rate-limit anonymous requests to /cart, /checkout and order endpoints.

4. Hunt for compromise. Honesty first: Drupal published no IOCs, so this is behavioral, not signature-based.

• Follow the vendor's instruction — audit orders for inconsistencies: unexpected prices, totals, applied discounts or coupons, and status changes you did not initiate (stored-data manipulation, ATT&CK T1565.001).
• Review web-server and Drupal access logs for anonymous or low-privilege requests that reached order, product-pricing or checkout routes and returned 200 rather than 403 — the fingerprint of forceful browsing against a public-facing app (T1190).
• Look for data access with no corresponding order change: reads of customer or order data that should have required authentication.

5. Eradicate + verify. After patching: reverse or quarantine fraudulent orders; rotate any API keys or OAuth credentials used by decoupled front-ends or payment integrations that touch Commerce, in case non-public configuration was read; then confirm the fix holds by re-testing that anonymous requests to the previously reachable routes now return 403. Verifying after the patch is the step most teams skip.

What is not known yet

• No official CVSS. NVD lists the CVE as "Received" and unscored; the only severity rating is Drupal's own 21/25.
• Which routes and fields. Drupal withheld the specifics to slow copycats, so defenders cannot write a precise rule and cannot confirm exposure from the advisory alone.
• Scale and attribution. No count of affected stores, no actor, no start date, no sample of the attack traffic.
• No public PoC or IOCs are named by any source we could verify, though Drupal's E:Exploit vector says working exploit code is already deployed.
• CISA KEV. Not listed as of catalog version 2026.10.29; that can change within days for a flaw this widely deployed and confirmed exploited.

Proving exposure when the vendor won't say how

The uncomfortable part of this disclosure is structural: Drupal did the responsible thing and withheld the route and field names, which means the usual defensive reflex — feed the CVE to a scanner and wait for a signature — returns nothing useful. You are left asking "am I actually reachable?" with no way to answer it from the advisory.

That is the question an autonomous AI red team is built to settle. Zero Hunt runs on-premise on its own private models, so for a case like this it identifies the exact Commerce Core version installed on your appliance-scoped target and performs gray-box analysis of that version's source for the input-reachable access-control gap, rather than matching a pattern it was handed. Its Exploit Forge then iterates a runnable proof-of-concept against your own configuration until it either demonstrates that an unauthenticated request reaches a protected order route or field — or shows it does not — with every step gated by a human in the loop and signed at write time for the audit trail. That is a verdict about your store, not an industry average, and it is the same kind of gray-box, source-informed validation covered in our guide to automated penetration testing. For storefronts that process cards, it is also the evidence a PCI DSS Requirement 11.4 assessor will ask for after an exploited-in-the-wild event.

The traffic side closes the gap the order audit leaves open. Zero Hunt's deep-learning traffic model — four inference heads running on the appliance GPU — reads anonymous and low-privilege requests reaching gated commerce routes as the anomaly they are, while the forceful browsing is happening, not in the morning's order report. For the second e-commerce platform under mass attack this month after Adobe Commerce CVE-2026-48356, the difference between seeing it live and reading about it later is the difference between a contained incident and a disclosure of your own.