Drupal confirms active exploitation of an access bypass in Commerce Core that may financially impact merchants. Update the affected module and audit orders for inconsistencies.
Who should check: Operators of stores and decoupled applications using affected releases of the Drupal Commerce Core module.
Update Commerce Core to 3.3.13 or 8.x-2.41 for the applicable branch, verify the deployed version and audit orders for inconsistencies.
Commerce Core does not sufficiently protect certain routes and entity fields. The October 28 advisory confirms exploitation in the wild; it does not establish when attacks began. Scope this advisory to affected Commerce installations, including decoupled applications using its APIs.
The fixes are branch-specific. Updating Drupal core alone does not replace the affected Commerce module. The vendor also calls for auditing orders for inconsistencies. Preserve relevant records and investigate unexplained differences; patching does not reverse earlier changes to orders.
Drupal's Highly critical rating uses its own 21/25 risk scale. It is not a CVSS score. The release pages address several advisories; the exploitation evidence here applies specifically to CVE-2026-118539.
| Product | Affected | Fixed release / action |
|---|---|---|
| Commerce Core — earlier branch | Earlier releases below 2.41; the vendor recommends the 8.x-2.41 release. | 8.x-2.41 |
| Commerce Core 3.x | 3.0.0 through versions before 3.3.13 | 3.3.13 |
Use the guidance for your product and release branch. Confirm distribution backports with the vendor; the product name alone does not establish exposure.
Drupal confirms exploitation in the wild and rates authentication as not required. Prioritize affected Commerce deployments because the access bypass can financially impact merchants.
Check agent integrations only if they use the affected Commerce routes or entity fields. The advisory does not establish AI involvement in exploitation.
Added coverage of the October 28 vendor advisory, branch-specific fixes and order-audit guidance.
Use this checklist to decide whether the advisory affects your systems, record what your team does and share the result. Radar does not scan or verify your environment.
Changes save automatically in this browser. They are not synced with your team or sent to Oktsec.
Check affected systems and versions, then record your decision below. If you are unsure, choose “Needs verification”.
Name the system and person or team handling the work. Update each action as you go; add a ticket reference or notes to explain what was checked.
Identify installations using drupal/commerce, record the deployed version and map storefront and API entry points. A Drupal installation without the affected module does not establish exposure.
Install Commerce Core 3.3.13 for 3.x, or 8.x-2.41 for the earlier branch, using the site's dependency and deployment process. Verify the running version rather than relying only on a changed lockfile.
The vendor requires an order audit alongside the update. Oktsec recommends reconciling orders with payment and fulfillment records, preserving unexplained discrepancies and related logs for investigation.
Check legitimate checkout and order-management operations after deployment. Record the installed version, order-review scope and unresolved discrepancies. A successful update does not establish that earlier orders were unaffected.
Download a Markdown file with your decision, action status, notes and source links. Share it with your team or attach it to a ticket.
Compare the running version and configuration with the vendor guidance.
| Product | Affected | Fixed release / action |
|---|---|---|
| Commerce Core — earlier branch | Earlier releases below 2.41; the vendor recommends the 8.x-2.41 release. | 8.x-2.41 |
| Commerce Core 3.x | 3.0.0 through versions before 3.3.13 | 3.3.13 |
Confirm distribution backports with the vendor. A matching product alone does not establish exposure.
Drupal confirms exploitation in the wild and rates authentication as not required. Prioritize affected Commerce deployments because the access bypass can financially impact merchants.
Prioritization criteriaCatalog 2026.10.29 · Checked Oct 30, 2026 UTC
No matching CVE appears in the reviewed catalog snapshot. This does not establish that exploitation has not occurred. Check the incident sources and vendor guidance.
| Product / CVE | Attack evidence | Source guidance |
|---|---|---|
| Commerce CoreCVE-2026-118539 | Attacks confirmed Reported by the sources linked in this advisory. | Drupal sourceReview affected systems |
Forecast unavailable. This is not a zero score.
FIRST EPSS · Checked 2026-10-27 15:30 UTC
Priority applies to the parent advisory, not separately to every product or CVE. Each row shows only the evidence attributed to that CVE. Missing attack evidence does not mean a vulnerability is safe to ignore. Your environment has not been scanned.
Technical facts come from these sources. Response priorities and recommended actions are Oktsec’s analysis.
| Product / service | Commerce CoreDrupal |
|---|---|
| CVE | CVE-2026-118539 |
| Exploitation evidence | Attacks confirmed |
| Access required | No login required |
| Fix / response | Fix availableAffected versions and fixes |
Check agent integrations only if they use the affected Commerce routes or entity fields. The advisory does not establish AI involvement in exploitation.