Drupal stores: attackers are using a Commerce Core flaw that can cost you money. Update and audit your orders

If your online store runs on Drupal Commerce, Drupal’s security team wants two things from you: an update and a look through your orders. A flaw in the Commerce Core module lets people reach routes and fields they should not, and Drupal says it is being used in the wild.

Drupal’s own wording is that the bug “may financially impact the vendor,” which is why the second step is an order audit.

Drupal’s advice is to patch and then check your orders, because the bug can cost the store money.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

Drupal says a Commerce Core flaw is being used against stores

Drupal published SA-CONTRIB-2026-254 on October 28 and rated it highly critical, 21 out of 25. The score means no special access or configuration is needed and an exploit exists. The module “doesn’t sufficiently protect certain routes and entity fields,” and Drupal says the vulnerability “is being actively exploited in the wild.” The CVE is CVE-2026-118539.

Drupal has not said how the bug is exploited, who is behind it or how many stores were hit, SecurityWeek reports. It also has not said whether attacks began before the fix.

The 42,000 Drupal sites that run Commerce Core

Commerce Core runs on more than 42,000 sites, according to Drupal’s usage statistics cited by BleepingComputer and SecurityWeek. Affected versions are everything before 8.x-2.41 on the old branch, and 3.0.0 up to but not including 3.3.13.

The same October 28 release carried 38 other advisories for 21 contributed projects. SecurityWeek says nearly a dozen are rated critical, including one in which Commerce orders paid through Stripe could be marked as paid without payment.

Update to 3.3.13 or 8.x-2.41, then audit orders

• Update Commerce Core to 3.3.13 on the 3.x branch, or to 8.x-2.41 on older sites, then rebuild caches.
• Audit orders since mid-October for inconsistencies, as Drupal advises: totals that do not match line items, odd discounts or adjustments, and orders in a paid or completed state with no matching payment.
• While you are in the update screen, apply the other October 28 contributed-module advisories that touch your site, starting with the Commerce and payment modules.

Details

• Advisory: SA-CONTRIB-2026-254, Commerce Core (commerce), access bypass, highly critical, 21/25 (AC:None/A:None/CI:Some/II:Some/E:Exploit/TD:All), October 28, 2026.
• CVE: CVE-2026-118539. Affected: versions before 2.41, and 3.0.0 up to 3.3.13. Fixed: 3.3.13 and 8.x-2.41.
• Exploitation: confirmed by Drupal; details, actors and timing not published.
• Also: Canada’s Cyber Centre published advisory AV26-1105 on October 30, citing open-source reporting of exploitation.

Hunt / verify

• Run composer show drupal/commerce or check Reports, Available updates to confirm the installed version on every store.
• Export orders since mid-October and compare order totals, adjustments and states with your payment gateway’s records.
• Review web logs for unusual requests to cart, checkout and order routes, and API calls from clients you do not recognize if the store runs decoupled.

Source: Drupal advisory SA-CONTRIB-2026-254; SecurityWeek report

Sources

• Drupal.org: Commerce Core, Highly critical, Access bypass, SA-CONTRIB-2026-254
• BleepingComputer: Drupal warns of critical Commerce Core flaw exploited in attacks
• SecurityWeek: Drupal Commerce Core Vulnerability Exploited Against Online Stores
• Canadian Centre for Cyber Security: Drupal security advisory (AV26-1105)
• NVD: CVE-2026-118539

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].