# Drupal Commerce Core access bypass actively exploited (CVE-2026-118539, SA-CONTRIB-2026-254) · pwn.watch

> Drupal Commerce Core, the shopping cart and checkout module for Drupal stores, doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor. The Drupal Security Team rates it Highly critical (21/25, no access needed) and says it is being actively exploited in the wild. Upgrade to Commerce Core 3.3.13 or 8.x-2.41, and audit orders for inconsistencies.

Page: https://pwn.watch/i/drupal-commerce-core-access-bypass-cve-2026-118539 · generated 2026-10-30T05:37:51.190Z

## Status
- Severity: critical · status: live · patch: patched
- Product: Drupal Commerce Core (commerce module)
- Started: 2026-10-28
- CVEs: CVE-2026-118539
- Affected: Commerce Core < 2.41; Commerce Core >= 3.0.0, < 3.3.13
- Fixed in: Commerce Core 8.x-2.41; Commerce Core 3.3.13

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/drupal-commerce-core-access-bypass-cve-2026-118539/feed.xml
- JSON Feed: https://pwn.watch/i/drupal-commerce-core-access-bypass-cve-2026-118539/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/drupal-commerce-core-access-bypass-cve-2026-118539.json
- This file: https://pwn.watch/i/drupal-commerce-core-access-bypass-cve-2026-118539/llms.txt

## Updates (newest first)
- 2026-10-28: Drupal Security Team publishes SA-CONTRIB-2026-254 (CVE-2026-118539): Highly critical access bypass in Commerce Core, actively exploited in the wild; fixed in 3.3.13 and 8.x-2.41. (https://www.drupal.org/sa-contrib-2026-254)

## Fix brief
# Security brief: Drupal Commerce Core access bypass actively exploited (CVE-2026-118539, SA-CONTRIB-2026-254)

Source: https://pwn.watch/i/drupal-commerce-core-access-bypass-cve-2026-118539 · status: live · severity: critical · updated Oct 30, 2026, 03:36 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
Drupal Commerce Core, the shopping cart and checkout module for Drupal stores, doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor. The Drupal Security Team rates it Highly critical (21/25, no access needed) and says it is being actively exploited in the wild. Upgrade to Commerce Core 3.3.13 or 8.x-2.41, and audit orders for inconsistencies.

Severity detail: Drupal 'Highly critical' 21/25 (AC:None/A:None); actively exploited per the Drupal Security Team

- Product: Drupal Commerce Core (commerce module)
- CVE / advisory ids: CVE-2026-118539

## Affected versions
- Commerce Core < 2.41
- Commerce Core >= 3.0.0, < 3.3.13

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- Commerce Core 8.x-2.41
- Commerce Core 3.3.13

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Specific notes
If a Drupal site uses the commerce module below 3.3.13 (or 8.x-2.x below 2.41), update it (composer update drupal/commerce) and audit recent orders for inconsistencies.

## Latest updates
- Oct 28, 2026: Drupal Security Team publishes SA-CONTRIB-2026-254 (CVE-2026-118539): Highly critical access bypass in Commerce Core, actively exploited in the wild; fixed in 3.3.13 and 8.x-2.41.

## Advisories
- [Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254](https://www.drupal.org/sa-contrib-2026-254) (Drupal Security Team)
- [CVE-2026-118539](https://nvd.nist.gov/vuln/detail/CVE-2026-118539) (NVD)

---
Machine-readable: https://pwn.watch/i/drupal-commerce-core-access-bypass-cve-2026-118539.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.