ARTICLE ORIGINAL MAG212 CYBER

La vulnérabilité CVE-2026-118539 du noyau de Drupal Commerce est exploitée : appliquez le correctif, puis auditez vos commandes.

novembre 4, 2026 · El Mostafa Ouchen

Drupal’s Security Team has rated CVE-2026-118539, an access bypass in the Commerce Core module, “highly critical” and says it is being actively exploited. Commerce Core powers shopping carts, checkout and API-driven storefronts on more than 42,000 Drupal sites. The flaw lets attackers reach certain routes and entity fields they should not, and change orders in ways that can cost a store money.

Updating closes the hole. It does not show whether anyone already used it, which is why Drupal tells store owners to audit their orders as well.

Faits clés

Article	Détail
Advisory	SA-CONTRIB-2026-254, published October 28, 2026
CVE	CVE-2026-118539 (CWE-862, missing authorization)
Risk rating	Highly critical, 21/25
Exploitation	Drupal: “actively exploited in the wild”
Affected	Commerce Core below 2.41, and 3.x below 3.3.13
Fixed	8.x-2.41 or 3.3.13
Login needed?	No, per BleepingComputer’s reading of the advisory

What the flaw does

The advisory says the module does not sufficiently protect certain routes and entity fields, which leads to an access bypass that “may financially impact the vendor.” Drupal has not published how the flaw is exploited, who is behind the activity, or how many sites have been targeted. Treat any store on an affected version since late October as a candidate for review.

Step 1: update Commerce Core

Sites on the 3.x branch should move to 3.3.13. Sites on earlier releases should move to 8.x-2.41. With Composer and Drush, a typical 3.x update looks like this (take a database backup first and test on staging where you can):

composer show drupal/commerce                # current installed version
composer require 'drupal/commerce:^3.3.13' --with-all-dependencies
drush updatedb -y
drush cache:rebuild
composer show drupal/commerce                # confirm 3.3.13 or later

Drupal published 38 other contributed-project advisories the same day, including several for Commerce Stripe, Commerce Shipping and Commerce License. Update those too if you run them.

Step 2: audit your orders

Drupal does not specify what “inconsistencies” look like, so here is a practical checklist from MAG212 CYBER. Cover orders placed or changed since October 28, 2026:

Reconcile with your payment gateway: every completed order should have a matching captured payment for the same amount and currency.
Look for odd totals: zero, negative, or unusually low totals; discounts or adjustments nobody configured; prices that don’t match the catalog.
Check state changes: orders moved to completed or fulfilled without a payment, or edited after placement.
Review fulfilment: shipments or licenses issued for orders that fail the checks above.
Check access: new admin or store-manager accounts, and unusual API activity from unfamiliar addresses in your web logs.

If you find suspect orders, preserve the order records and logs before you correct anything, then decide with your payment provider how to handle chargebacks, refunds or cancelled fulfilment.

Commands follow Composer and Drush documentation but were not run against a live site for this article.

Foire aux questions

Which Commerce Core version fixes CVE-2026-118539?

3.3.13 on the 3.x branch, or 8.x-2.41 for earlier releases.

Is it really being exploited?

Yes, according to Drupal’s own advisory. It has not published details of the activity.

I updated. Do I still need to audit?

Yes. The update stops new abuse but does not reveal or reverse changes made before you patched.

Read today’s full MAG212 CYBER Daily (free) →

Abonnez-vous gratuitement