Drupal Commerce
Security incidents tagged Drupal Commerce. Newest first.
1 Drupal Commerce incident in the last 12 months
Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore
- Incidents
- 1
- Live
- 1
- Patched
- 1
- Days without an incident
- 2
- Longest quiet run: 2 days (Oct 29–Oct 30)
- Patched
Drupal Commerce Core access bypass actively exploited (CVE-2026-118539, SA-CONTRIB-2026-254)
Drupal Commerce Core, the shopping cart and checkout module for Drupal stores, doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor. The Drupal Security Team rates it Highly critical (21/25, no access needed) and says it is being actively exploited in the wild. Upgrade to Commerce Core 3.3.13 or 8.x-2.41, and audit orders for inconsistencies.
Drupal Commerce Core (commerce module)Since Oct 28, 2026
