# Drupal Commerce: patch active exploitation and audit orders Canonical: https://www.oktsec.com/radar/drupal-commerce-cve-2026-118539 Publisher: Oktsec Language: en Published: 2026-11-01T00:22:00Z Updated: 2026-11-01T00:22:00Z Record reviewed: 2026-11-01T00:22:00Z Latest evidence check: 2026-11-01T00:22:00Z Disclosed: 2026-10-28 Drupal confirms active exploitation of an access bypass in Commerce Core that may financially impact merchants. Update the affected module and audit orders for inconsistencies. ## Evidence and response priority - Category: Vulnerability - Oktsec priority: Act now - Rationale: Drupal confirms exploitation in the wild and rates authentication as not required. Prioritize affected Commerce deployments because the access bypass can financially impact merchants. - Evidence: Attacks confirmed - Verification: Vendor confirmed - Fix status: Fix available - Exposure requirement: No login required - Vendor: Drupal - Products: Commerce Core - CVEs: CVE-2026-118539 ## Technical overview Commerce Core does not sufficiently protect certain routes and entity fields. The October 28 advisory confirms exploitation in the wild; it does not establish when attacks began. Scope this advisory to affected Commerce installations, including decoupled applications using its APIs. The fixes are branch-specific. Updating Drupal core alone does not replace the affected Commerce module. The vendor also calls for auditing orders for inconsistencies. Preserve relevant records and investigate unexplained differences; patching does not reverse earlier changes to orders. Drupal's Highly critical rating uses its own 21/25 risk scale. It is not a CVSS score. The release pages address several advisories; the exploitation evidence here applies specifically to CVE-2026-118539. ## Recommended response Update Commerce Core to 3.3.13 or 8.x-2.41 for the applicable branch, verify the deployed version and audit orders for inconsistencies. Relevant to: Operators of stores and decoupled applications using affected releases of the Drupal Commerce Core module. ## CVE attribution - CVE-2026-118539: Drupal — Commerce Core. [Source](https://www.drupal.org/sa-contrib-2026-254) ## Affected systems and fixes ### Commerce Core — earlier branch Affected: Earlier releases below 2.41; the vendor recommends the 8.x-2.41 release. Fixed release / action: 8.x-2.41 ### Commerce Core 3.x Affected: 3.0.0 through versions before 3.3.13 Fixed release / action: 3.3.13 Confirm the running version against the vendor advisory, including any distribution backports. ## CISA KEV evidence Catalog: 2026.10.29 Checked: 2026-10-30T10:27:08.428Z No matching CVE appears in the reviewed catalog snapshot. CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America. ## Supporting evidence Snapshot checked: 2026-10-27T15:30:57.206Z. These dates do not change the incident’s editorial review date. ### FIRST EPSS forecast No score returned for: CVE-2026-118539 EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-10-27T15:30:57.206Z. ## Response checklist 1. **Find affected Commerce deployments** — Identify installations using drupal/commerce, record the deployed version and map storefront and API entry points. A Drupal installation without the affected module does not establish exposure. 2. **Update the applicable module branch** — Install Commerce Core 3.3.13 for 3.x, or 8.x-2.41 for the earlier branch, using the site's dependency and deployment process. Verify the running version rather than relying only on a changed lockfile. 3. **Audit orders for inconsistencies** — The vendor requires an order audit alongside the update. Oktsec recommends reconciling orders with payment and fulfillment records, preserving unexplained discrepancies and related logs for investigation. 4. **Verify checkout and record findings** — Check legitimate checkout and order-management operations after deployment. Record the installed version, order-review scope and unresolved discrepancies. A successful update does not establish that earlier orders were unaffected. ## Relevance to AI environments Check agent integrations only if they use the affected Commerce routes or entity fields. The advisory does not establish AI involvement in exploitation. ## Sources - [SA-CONTRIB-2026-254: Commerce Core access bypass](https://www.drupal.org/sa-contrib-2026-254) — Drupal; Vendor notice; checked 2026-11-01T00:22:00Z - [Commerce Core 3.3.13 security release](https://www.drupal.org/project/commerce/releases/3.3.13) — Drupal; Vendor notice; checked 2026-11-01T00:22:00Z - [Commerce Core 8.x-2.41 security release](https://www.drupal.org/project/commerce/releases/8.x-2.41) — Drupal; Vendor notice; checked 2026-10-31T23:54:40Z ## Editorial record - 2026-11-01T00:22:00Z: Added coverage of the October 28 vendor advisory, branch-specific fixes and order-audit guidance. ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/drupal-commerce-cve-2026-118539) · [Build a response plan](https://www.oktsec.com/radar/drupal-commerce-cve-2026-118539#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=drupal-commerce-cve-2026-118539&service=exposure_check) - [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=drupal-commerce-cve-2026-118539&service=patch_verification) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.