Drupal Commerce Core CVE-2026-118539 Access Bypass Actively Exploited: Patch to 3.3.13 / 8.x-2.41 and Audit Orders

TL;DR. Drupal rates CVE-2026-118539 in Commerce Core Highly critical (21/25) and says it is being actively exploited in the wild; Rescana treats it as Critical. The flaw lets attackers tamper with orders in ways that can cost a store money. What to do: upgrade Commerce Core to 3.3.13 (3.x) or 8.x-2.41 (older sites), update Commerce API, License, Shipping and Stripe at the same time, and audit recent orders using the maintainer's checklist. No CVSS score has been published. The CVE is not in CISA's Known Exploited Vulnerabilities (KEV) catalog.

On 28 October 2026 the Drupal Security Team published SA-CONTRIB-2026-254 for Commerce Core, the module behind Drupal Commerce shopping carts, checkout and API-driven (headless) storefronts (Drupal SA-CONTRIB-2026-254). Drupal says the module "doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor", and that "this vulnerability is being actively exploited in the wild."

A day later Centarro, the company that maintains Drupal Commerce, published a companion post in consultation with the Drupal Security Team (Centarro). It says the flaw came to light through two reports of attempts to place fraudulent orders, made by merchants who saw suspicious activity on their live stores. Centarro and the Drupal Security Team looked for wider abuse and, as of 29 October, do not believe it was scripted or exploited beyond those first sites.

What happened

The weakness is in order handling. According to Centarro, attackers tried to get orders accepted without paying in full. Reports included orders placed at obviously wrong prices, such as $0.01, and orders placed at normal prices. Because the bug is about who may change which parts of an order, the loss falls directly on the merchant: goods shipped, or access granted, without full payment.

Centarro says the flaw affects both traditional (full-stack) Drupal Commerce sites and headless sites that use Drupal's JSON:API module, with different attack routes for each. It also says exploitation has been theoretically possible for years: since Commerce Core 8.x-2.18 (May 2020) for sites using JSON:API, and since 8.x-2.25 (June 2021) for all others. Recent orders are therefore worth checking even on sites that patched quickly.

Technical information

Severity, as Drupal scores it. Drupal advisories are rated with the Drupal Security Team's own risk calculator, based on the NIST Common Misuse Scoring System, which scores 0 to 25; 20 and above is "Highly critical" (Drupal security risk levels). SA-CONTRIB-2026-254 scores 21 with the vector AC:None/A:None/CI:Some/II:Some/E:Exploit/TD:All. In Drupal's definitions that means:

• AC:None, A:None: no special steps and no account needed; anonymous visitors can reach it.
• CI:Some, II:Some: some non-public data can be exposed and some data can be changed.
• E:Exploit: exploit code exists in the wild.
• TD:All: all module configurations are exploitable.

The CVE record, published by Drupal as the CVE Numbering Authority, classifies the flaw as CWE-862 (Missing Authorization) (CVE-2026-118539).

What an attacker could change, per Centarro. Centarro's audit guidance points to four kinds of tampering, in rising order of sophistication: orders placed without going through payment; orders that look paid but have no payment behind them (mainly on sites that allow updates through JSON:API); product prices changed before checkout; and discounts, fees or other adjustments that staff did not add. Neither Drupal nor Centarro has published request-level details, and we do not describe any.

Related fixes in the same releases. Commerce Core 3.3.13 and 8.x-2.41 also fix five lower-rated Commerce Core advisories published the same day, SA-CONTRIB-2026-255 to SA-CONTRIB-2026-259 (information disclosure, access bypass and cross-site request forgery, rated Less critical to Moderately critical) (Commerce 3.3.13 release). Drupal also published same-day advisories for Commerce License, Commerce Shipping and Commerce Stripe; one Stripe issue, SA-CONTRIB-2026-263 (rated Critical), could let an attacker trick an administrator into clicking a link that bypasses Stripe payment, so an order is marked paid without any payment (Drupal contributed-project advisories). Of these Commerce advisories, Drupal reports active exploitation only for SA-CONTRIB-2026-254.

Exploitation status. Drupal and Centarro both say the flaw is being exploited. Centarro describes two reported cases and no evidence of wider, scripted abuse so far. Neither gives dates. We did not look for, and do not link to, any exploit code.

Timeline

All times Cyprus time (UTC+2).

• 26 May 2020: Commerce Core 8.x-2.18 released; per Centarro, the earliest version exposed on sites using JSON:API.
• 30 June 2021: Commerce Core 8.x-2.25 released; per Centarro, the earliest version exposed on other sites.
• Before 28 October 2026: Two merchants report fraudulent-order attempts; Centarro and the Drupal Security Team analyse the issue privately.
• 28 October 2026, 17:42 and 17:53: Commerce Core 3.3.13 and 8.x-2.41 release pages created.
• 28 October 2026, 18:54: Drupal publishes SA-CONTRIB-2026-254, Highly critical, actively exploited, with companion advisories.
• 29 October 2026: Centarro publishes its maintainer post with order-audit guidance.
• 30 October 2026, 05:09: CVE-2026-118539 record published by Drupal.
• 30 October 2026, 06:18: NVD lists the CVE as "Received", with no score.
• 30 October 2026, 16:10: Not in CISA KEV (catalog version 2026.10.29).

CVE, KEV and scoring status

• CVE: CVE-2026-118539, published 30 October 2026 by Drupal (CWE-862).
• CVSS: none. Neither Drupal's CVE record nor NVD carries a CVSS score, and NVD had not analysed the record when we checked on 30 October (NVD). We do not use third-party estimates. The severity that exists is Drupal's: Highly critical, 21 out of 25.
• KEV: CVE-2026-118539 is not listed in the CISA KEV catalog as of catalog version 2026.10.29, checked 30 October 2026 (CISA KEV catalog). "Actively exploited" here is Drupal's and Centarro's statement, not a KEV listing.

Affected product versions

Drupal's affected range covers every 8.x-2.x release before 8.x-2.41. Centarro dates theoretical exploitability to 8.x-2.18 (with JSON:API) and 8.x-2.25 (all other sites); older releases are long out of date and need the upgrade either way. Centarro also says support for 8.x-2.x will end when Drupal 12 is released, and recommends moving to 3.x.

Workaround and mitigation

1. Upgrade Commerce Core now: 3.3.13 on the 3.x branch, 8.x-2.41 on older sites (SA-CONTRIB-2026-254). Drupal lists no workaround that replaces the upgrade.

2. Update the companion modules at the same time. Centarro says it packaged security releases for Commerce API, Commerce License, Commerce Shipping and Commerce Stripe, and that sites should apply them together with Commerce Core (Centarro).

3. Set JSON:API to read-only if you do not need updates through it. Centarro recommends this for sites that do not need JSON:API write operations, while still updating as soon as possible.

4. Audit recent orders. Drupal says sites "should audit their orders for inconsistencies." Centarro's checklist:

   • orders placed but not paid, with no pending or authorized payment, on a site that does not sell free orders;
   • orders that show as paid but have no payment records behind them (mainly JSON:API sites);
   • prices that no promotion or configured adjustment explains, including order items with "Override the unit price" enabled when staff would not normally use it;
   • discounts, fees or other adjustments that staff did not add and no promotion produced.

   Centarro also publishes four database queries for teams that can run SQL against the site, and suggests matching suspect orders' IP address and time against access logs to confirm they came through the normal checkout path. Use the queries from Centarro's post directly; they also return legitimate staff actions, so results need judgment.

5. Confirm payment before you fulfil. Centarro says checkout completion only stages an order and that full payment should be confirmed before goods or services are delivered. Hold or review orders flagged by the audit before shipping or granting access (Rescana guidance).

6. Report anything new privately. Centarro asks anyone who sees suspicious behaviour that may be a new Drupal Commerce vulnerability to use Drupal's confidential security reporting process.

Indicators of compromise

Drupal and Centarro have not published indicators of compromise such as IP addresses, domains or file hashes, and we have none to add. Centarro's guidance is a review of order data, as above. No source we checked maps this flaw to MITRE ATT&CK techniques, and we have not done so.

What we will update

We will update this post if CISA adds CVE-2026-118539 to KEV, if NVD or Drupal publishes a CVSS score, if Drupal or Centarro revise their advisories or report wider exploitation, or if a national CERT issues guidance.

Sources

• Drupal Security Team: SA-CONTRIB-2026-254, "Commerce Core - Highly critical - Access bypass" (28 October 2026): https://www.drupal.org/sa-contrib-2026-254; contributed-project advisories (SA-CONTRIB-2026-255 to 265): https://www.drupal.org/security/contrib; security risk levels: https://www.drupal.org/drupal-security-team/security-risk-levels-defined; Commerce 3.3.13 release: https://www.drupal.org/project/commerce/releases/3.3.13; Commerce 8.x-2.41 release: https://www.drupal.org/project/commerce/releases/8.x-2.41
• Centarro (Drupal Commerce maintainer): "Update Drupal Commerce sites for an exploit observed in the wild", Ryan Szrama (29 October 2026): https://www.centarro.io/blog/update-drupal-commerce-sites-exploit-observed-wild
• CVE Program: CVE-2026-118539: https://www.cve.org/CVERecord?id=CVE-2026-118539
• NVD: CVE-2026-118539, no score as of 30 October 2026: https://nvd.nist.gov/vuln/detail/CVE-2026-118539
• CISA: not in the KEV catalog as of catalog version 2026.10.29, checked 30 October 2026: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Why this matters for your vendors

Many Drupal Commerce stores are built, hosted and run by agencies and managed service providers, and the same platform often sits behind B2B ordering portals, membership and licensing checkouts and course registrations. The main impact is on order integrity, so the cost is unpaid orders, wrong prices and goods shipped without payment, and it may surface only when finance reconciles.

Forward this to your TPRM owner: Questions for agencies, MSPs and suppliers that run Drupal Commerce for you, or whose storefront you buy through (Rescana guidance):

• Do you run Drupal Commerce, directly or for clients?
• Are all sites on Commerce Core 3.3.13 or 8.x-2.41, with the Commerce API, License, Shipping and Stripe security releases applied?
• Have you audited recent orders using the maintainer's checklist, and what did you find?
• Is JSON:API read-only where write access is not needed, and is payment confirmed before fulfilment?
• If any site is not yet fixed, when will it be?

Working through e-commerce and agency suppliers on questions like these? We can help you track their answers alongside the rest of their security posture. Talk to us.