Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyMonthly

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

← Live incidents
LivePatchedPatch now

Drupal Commerce Core access bypass actively exploited (CVE-2026-118539, SA-CONTRIB-2026-254)

Drupal Commerce Core (commerce module)

Drupal Commerce Core, the shopping cart and checkout module for Drupal stores, doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor. The Drupal Security Team rates it Highly critical (21/25, no access needed) and says it is being actively exploited in the wild. Upgrade to Commerce Core 3.3.13 or 8.x-2.41, and audit orders for inconsistencies.

Why this severity: Drupal 'Highly critical' 21/25 (AC:None/A:None); actively exploited per the Drupal Security Team

Started
Oct 28, 2026
CVE
CVE-2026-118539

Follow this incident

Discuss on X ↗

Affected

  • Commerce Core < 2.41
  • Commerce Core >= 3.0.0, < 3.3.13

Fixed in

  • Commerce Core 8.x-2.41
  • Commerce Core 3.3.13

Timeline1

  1. Drupal Security Team publishes SA-CONTRIB-2026-254 (CVE-2026-118539): Highly critical access bypass in Commerce Core, actively exploited in the wild; fixed in 3.3.13 and 8.x-2.41.

Advisories2

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Sponsored

Buy sponsor slot