Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcriticalExploited in the wild

Drupal says Commerce Core access bypass is being exploited

5 sources · 5 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Drupal says attackers are exploiting an unauthenticated Commerce Core access bypass; admins should patch and audit orders.

Drupal warned that CVE-2026-118539, a highly critical missing-authorization flaw in Commerce Core, is being exploited. The bug insufficiently protects certain routes and entity fields, needs no authentication, and affects all configurations of vulnerable releases used on more than 42,000 sites. Drupal scored it 21 out of 25 and said it may expose private information, change data, or financially affect vendors; the advisory does not describe remote code execution or full takeover. SecurityWeek, Cyber Security News, and the Canadian Centre treat 8.x-2.41 or 2.41 and 3.3.13 as fixes, while BleepingComputer and Security Affairs list ranges through those releases as affected. Drupal has not named attackers, methods, or how many sites were hit, and urges upgrades plus order audits.

Key facts
  • CVE-2026-118539 is SA-CONTRIB-2026-254 and scored 21 of 25.
  • Unauthenticated bypass works regardless of module configuration.
  • Commerce Core is used on more than 42,000 websites.
  • Dan Puccetti, Marcus Johansson, and Robert Snyder reported the flaw.
  • Drupal confirmed attacks but not actors, method, or site count.
  • Canadian Centre alert AV26-1105 covers the October 28 advisory.
Analyze CVE-2026-118539 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Oct 28, 2026Drupal published the Commerce Core access-bypass advisory. · Cyber Security News
  2. Oct 30, 2026Canadian Centre issued alert AV26-1105 on the flaw. · Canadian Centre for Cyber Security

What each outlet adds

beyond the shared facts
  • SecurityWeekDrupal has not said if exploitation was a zero-day.
  • Cyber Security NewsNames the three reporters and rules out full takeover.
  • BleepingComputerCites Fortune 500 companies and research universities among users.
  • Canadian Centre for Cyber SecurityAssigns alert AV26-1105 and advisory SA-CONTRIB-2026-254.
  • Security AffairsDescribes forceful browsing of insufficiently protected routes and fields.
CVEs
CVE-2026-118539
Vendors
Drupal
Products
Commerce Core
Organizations
Canadian Centre for Cyber Security

Coverage

oldest first · one row per article · UTC
  1. · 1d ago BleepingComputerFirst report

    Drupal Commerce Core access bypass exploited in attacks

    Unauthenticated attackers can bypass route and field protections on more than 42,000 sites and may cause financial loss.

  2. · 1d ago SecurityWeek

    Drupal Commerce Core access bypass exploited against online stores

    Unauthenticated attackers can hit the flaw on more than 42,000 sites; fixed releases are 3.3.13 and 8.x-2.41.

  3. · 1d ago Cyber Security News

    Drupal Commerce access bypass exploited in the wild (CVE-2026-118539)

    Unauthenticated attackers can reach protected routes and fields; sites should update and audit orders.

  4. · 1d ago Canadian Centre for Cyber Security

    Drupal Commerce Core access bypass reported exploited in the wild

    Releases before 2.41 and 3.0.0 before 3.3.13 are affected; Drupal rates the issue highly critical.

  5. · 9h ago Security Affairs

    Attackers exploit critical Drupal Commerce Core flaw CVE-2026-118539

    Missing checks on routes and entity fields affect Commerce Core through 2.41 and 3.3.13 and may cost vendors money.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-118539
Missing authorization in Drupal Commerce Core
6.5—