Drupal Commerce Vulnerability CVE-2026-118539: Critical Flaw Exploited, Update to 3.3.13 or 8.x-2.41
Attackers are exploiting a highly critical access bypass in Drupal Commerce Core. No login is needed to use it. Here is what is confirmed, which versions fix it, and how to check your store's orders.
Where Worldwide
On this page 9 sections
Drupal Commerce is the add-on that turns a Drupal website into an online store, and it has a critical security flaw that attackers are using right now. The Drupal Security Team says no login is needed to exploit it and that it can cost store owners money, so any business selling through Drupal Commerce should update to version 3.3.13 or 8.x-2.41 today and then check its recent orders.
What happened with Drupal Commerce
On Wednesday, October 28, 2026, the Drupal Security Team published advisory SA-CONTRIB-2026-254 for Commerce Core (module machine name commerce). It is tracked as CVE-2026-118539 and rated Highly critical, 21 out of 25 on Drupal's risk scale.
The same day, Drupal released Commerce Core 3.3.13 and Commerce Core 8.x-2.41. Both releases fix this flaw and five other Commerce Core advisories published alongside it (SA-CONTRIB-2026-255 through SA-CONTRIB-2026-259). Those five are rated less critical to moderately critical and cover two information disclosure issues, two more access bypass issues and one cross-site request forgery issue. Drupal's release pages say sites are "urged to update immediately."
The Commerce project page lists 42,002 sites reporting that they use the module.
Drupal Commerce exploit: what is confirmed and what is not
Confirmed by Drupal's advisory:
- It is an access bypass. The module does not properly protect certain routes and entity fields.
- No login is needed. The risk rating shows no access complexity, no authentication required and all configurations affected.
- Drupal states the vulnerability is being actively exploited in the wild.
- The advisory says it may cause financial harm to the vendor, meaning the business running the store, and tells sites to audit their orders for inconsistencies.
- Affected: all versions before 8.x-2.41, and 3.x versions from 3.0.0 up to but not including 3.3.13.
Not known yet:
- Which routes and fields are involved. Drupal has not published technical details, which is normal while sites are still patching.
- Who is exploiting it, how many stores have been hit, and exactly what attackers do once they are in. Some coverage describes this as transaction manipulation. The advisory itself only says financial harm and order inconsistencies.
- What Drupal 7 stores on Commerce 1.x should do. The advisory names fixes only for 3.3.13 and 8.x-2.41.
One point to clear up: some news reports list the affected range as "through 2.41" and "through 3.3.13". The advisory is clear that 3.3.13 and 8.x-2.41 are the fixed releases. If you are on one of those, you have the fix.
Which Drupal Commerce versions are affected
| Your Commerce branch | Works with Drupal core | Vulnerable | Update to |
|---|---|---|---|
| Commerce 3.x | 10.3 or later, or 11 | 3.0.0 through 3.3.12 | 3.3.13 |
| Commerce 2.x (8.x-2.x) | 9.3 or later, or 10 | anything before 8.x-2.41 | 8.x-2.41 |
How to check your Drupal Commerce version
Use any of these:
- Command line: run
composer show drupal/commercein the site's project folder. The version is shown near the top. - Admin screen: go to Reports, then Available updates (
/admin/reports/updates). If the Update Manager module is on, Drupal flags missing security releases in red. - Extend page: the module list shows the installed version of each Commerce submodule.
If your site was built by an agency or freelancer and you have no access to any of these, ask them today and ask for the version number in writing.
How to update Drupal Commerce
Back up the database and files first. Then, from the project folder:
composer update drupal/commerce --with-all-dependencies
drush updatedb
drush cache:rebuild
Run composer show drupal/commerce again to confirm you now have 3.3.13 or 8.x-2.41. If you have a staging site, test checkout there first, but because this flaw is already being exploited, plan for hours, not weeks.
Drupal security update checklist for this week
| Task | How | Why |
|---|---|---|
| Confirm your version | composer show drupal/commerce or Available updates |
You need to know if you are exposed |
| Update Commerce Core | 3.3.13 for 3.x, 8.x-2.41 for 2.x | Closes CVE-2026-118539 and five other flaws |
| Audit recent orders | Look for totals or prices that do not match the products, orders marked paid or complete with no matching payment, unexpected discounts or adjustments, and orders tied to the wrong customer | Drupal asks stores to check for inconsistencies |
| Match orders to your payment provider | Compare paid orders in Drupal against your payment gateway's dashboard | A paid order with no real payment is a direct loss if you ship it |
| Review logs | Drupal's Recent log messages (/admin/reports/dblog) and web server logs for unusual anonymous activity on cart, checkout and API pages |
Helps show whether your store was targeted |
| Hold suspicious orders | Pause fulfilment on anything that does not reconcile | Stops goods leaving the building on bad orders |
| If you cannot update today | Ask your developer or host about taking checkout offline until the update is in | Reduces exposure while you wait |
| Get future alerts | Subscribe to Drupal security advisories at drupal.org/security | Module flaws like this one are announced there first |
Why this matters for a business running an online store
This is not a defaced home page. Drupal says the flaw can cause financial harm to the store owner, and the fix advice points straight at orders. For a retailer, distributor or membership business, that means the risk lands in money and inventory: an order that looks paid but is not, a price that should not have been allowed, or goods shipped that will never be paid for.
It also needs no password. An attacker does not have to phish your staff or guess a login. They only need to find a store running an old version, and online stores are easy to find.
There is a people problem too. Many Drupal stores were built by an outside developer, launched, and then left alone. Drupal core updates may be handled by a host, but a contributed module like Commerce often is not. If nobody is clearly responsible for module updates, a fix released on a Wednesday can sit uninstalled for months.
Drupal Commerce vulnerability questions people are asking
Is my Drupal site affected if it does not sell anything?
Only if the Commerce Core module is installed. This advisory is about the Commerce module, not Drupal core. Check the Extend page or run composer show drupal/commerce.
Does an attacker need to log in?
No. Drupal's risk rating shows no authentication is required.
Some articles say "through 3.3.13". Is 3.3.13 safe?
Yes. Drupal's advisory lists 3.3.13 and 8.x-2.41 as the fixed versions. Anything below those is vulnerable.
Is the Drupal Commerce flaw being exploited?
Yes. Drupal's advisory states it is being actively exploited in the wild. The scale and the attackers are not public.
What should I look for in my orders?
Drupal only says "inconsistencies." Start with orders whose totals do not match their items, orders marked paid without a matching payment in your gateway, and unexpected discounts or status changes.
What about Drupal 7 stores on Commerce 1.x?
The advisory names no fix for that branch. Talk to your developer about whether your store is affected and about a plan to move to a supported version.
Do I need to update Drupal core as well?
This fix is in the Commerce module. Commerce 3.3.13 needs Drupal 10.3 or later, or 11. Keeping core current is still good practice.
The bigger lesson
The parts of a website that touch money are the parts attackers care about most, and they are often add-on modules that fall outside whatever update routine a site has. Know every module your store runs, know who updates it, and make sure that person hears about advisories the day they come out.
If you want someone to own that for you, see our security hardening service or request a quote.
Get security alerts like this by email, plus our free checklist, at /security-alerts.
Sources: Drupal SA-CONTRIB-2026-254; Commerce Core 3.3.13 release; Commerce Core 8.x-2.41 release; Drupal Commerce project page.
Have a question about this article?
Ask it here and we will answer you directly by email. Questions are private, never posted.
Security alerts by email
Hear about the next one first.
When attackers start using a flaw in software businesses run on, we email what it is, whether it touches you and what to do that week, with a round-up of our latest security writing. Free, one-click unsubscribe. You get the checklist straight away: 12 things to secure this week.
Want a result like this?
Security alerts, breaches and the technology a business runs on: what happened, who it affects and what to do.
Get a Tech QuoteKeep reading
Mittwald MCP Server Breach: An Attacker Used a Web Host's AI Assistant Connector to Compromise 56 Customer Projects, What Is Confirmed and What to Check
German web host Mittwald says an attacker got in through the MCP server customers use to connect AI assistants...
Nitori Data Breach: Up to 37.62 Million Records May Have Leaked, What Is Confirmed and What Businesses Should Check
Nitori Holdings says up to 37.62 million records of personal information may have leaked after a break-in conf...
Sega Data Breach: 2.2 Million Email Addresses Leaked Through Email Vendor Arara, What Is Confirmed and What to Check
Sega says 2,196,044 newsletter email addresses leaked in a breach at its email vendor Arara, whose total has g...
