Drupal Commerce Core access bypass reported exploited in the wild
Original title: Drupal security advisory (AV26-1105)
Releases before 2.41 and 3.0.0 before 3.3.13 are affected; Drupal rates the issue highly critical.
The Canadian Centre for Cyber Security issued AV26-1105 on October 30, 2026, covering Drupal Commerce Core. As of October 28, versions prior to 2.41 and 3.0.0 versions prior to 3.3.13 are affected by access-bypass CVE-2026-118539, tracked as SA-CONTRIB-2026-254. Open-source reporting indicates the flaw is being exploited, and administrators are told to apply available updates.
Unconfirmed: In-the-wild exploitation is attributed to open-source reporting, not confirmed by the Cyber Centre.
- Drupal rates Commerce Core SA-CONTRIB-2026-254 highly critical.
- The Cyber Centre alert is serial AV26-1105, dated October 30, 2026.
- Fixed versions stated are 2.41 and 3.3.13.
Impact: access bypass in Drupal Commerce Core
| Product | Affected | Fixed in |
|---|---|---|
| Drupal Commerce Core | prior to 2.41 and 3.0.0 versions prior to 3.3.13 | 2.41 and 3.3.13 |
- 1.Update Commerce Core to 2.41 or 3.3.13.
- 2.Review Drupal advisory SA-CONTRIB-2026-254.
- CVEs
- CVE-2026-118539
- Vendors
- Drupal
- Products
- Commerce Core
- Organizations
- Canadian Centre for Cyber Security
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-118539 | Missing authorization in Drupal Commerce Core | 6.5 | — |
From the original article
1 min read at cyber.gc.ca
Serial number: AV26-1105 Date: October 30, 2026 As of October 28, 2026, Drupal is affected by a vulnerability in the following product: Commerce Core Versions prior to 2. 41 and 3. 0.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.