Drupal Commerce Core access bypass actively exploited (CVE-2026-118539, SA-CONTRIB-2026-254) ยท updates https://pwn.watch/i/drupal-commerce-core-access-bypass-cve-2026-118539 Drupal Commerce Core, the shopping cart and checkout module for Drupal stores, doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor. The Drupal Security Team rates it Highly critical (21/25, no access needed) and says it is being actively exploited in the wild. Upgrade to Commerce Core 3.3.13 or 8.x-2.41, and audit orders for inconsistencies. en Wed, 28 Oct 2026 00:00:00 GMT Drupal Commerce Core access bypass actively exploited (CVE-2026-118539, SA-CONTRIB-2026-254): Drupal Security Team publishes SA-CONTRIB-2026-254 (CVE-2026-118539): Highly critical access bypass in Commerce Core, actively exploited in the wild; fixed in 3.3.13 and 8.x-2.41. https://pwn.watch/i/drupal-commerce-core-access-bypass-cve-2026-118539 https://pwn.watch/i/drupal-commerce-core-access-bypass-cve-2026-118539#2026-10-28-95f927c0 Wed, 28 Oct 2026 00:00:00 GMT critical <p><a href="https://www.drupal.org/sa-contrib-2026-254">Source</a></p>