https://reddit.com/r/cybersecurity/comments/1xknrsz/commerce_core_highly_critical_access_bypass/: Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254

Q: Which Commerce Core deployments should be treated as affected?

Commerce Core 3.x deployments should upgrade to 3.3.13, and deployments on the older supported branch should upgrade to 8.x-2.41. The provided advisory information does not identify unaffected configurations within those branches.

Q: Is exploitation only theoretical?

No. Drupal's security team states that attackers are actively exploiting CVE-2026-118539 in the wild, although the advisory does not say how many stores have been compromised.

Q: What should merchants do besides applying the upgrade?

Audit orders for inconsistencies after upgrading. The advisory warns that patching alone may not identify unauthorized changes that were already made, including changes that could create fraudulent or inconsistent orders.

Q: What could an attacker change if exploitation succeeds?

Insufficient protection of routes and entity fields can allow unauthorized changes. For e-commerce operators, the reported consequences include fraudulent or inconsistent orders and potential financial impact.

Published Oct 31, 2026

Updated

Affected Software

1 affected component

Drupal Commerce Core<3.3.13, <8.x-2.41

Frequently Asked Questions

Which Commerce Core deployments should be treated as affected?

Commerce Core 3.x deployments should upgrade to 3.3.13, and deployments on the older supported branch should upgrade to 8.x-2.41. The provided advisory information does not identify unaffected configurations within those branches.

Is exploitation only theoretical?

No. Drupal's security team states that attackers are actively exploiting CVE-2026-118539 in the wild, although the advisory does not say how many stores have been compromised.

What should merchants do besides applying the upgrade?

Audit orders for inconsistencies after upgrading. The advisory warns that patching alone may not identify unauthorized changes that were already made, including changes that could create fraudulent or inconsistent orders.

What could an attacker change if exploitation succeeds?

Insufficient protection of routes and entity fields can allow unauthorized changes. For e-commerce operators, the reported consequences include fraudulent or inconsistent orders and potential financial impact.