{"id":3919,"date":"2026-11-04T06:51:12","date_gmt":"2026-11-04T14:51:12","guid":{"rendered":"https:\/\/cyber.mag212.com\/drupal-commerce-core-cve-2026-118539-exploited\/"},"modified":"2026-11-04T06:51:12","modified_gmt":"2026-11-04T14:51:12","slug":"drupal-commerce-core-cve-2026-118539-exploited","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/drupal-commerce-core-cve-2026-118539-exploited\/","title":{"rendered":"La vuln\u00e9rabilit\u00e9 CVE-2026-118539 du noyau de Drupal Commerce est exploit\u00e9e\u00a0: appliquez le correctif, puis auditez vos commandes."},"content":{"rendered":"

Drupal’s Security Team has rated CVE-2026-118539<\/strong>, an access bypass in the Commerce Core<\/strong> module, “highly critical” and says it is being actively exploited. Commerce Core powers shopping carts, checkout and API-driven storefronts on more than 42,000 Drupal sites. The flaw lets attackers reach certain routes and entity fields they should not, and change orders in ways that can cost a store money.<\/p>\n\n

Updating closes the hole. It does not show whether anyone already used it, which is why Drupal tells store owners to audit their orders<\/strong> as well.<\/p>\n\n

Faits cl\u00e9s<\/h2>\n\n
Article<\/th>D\u00e9tail<\/th><\/tr><\/thead>
Advisory<\/td>SA-CONTRIB-2026-254, published October 28, 2026<\/td><\/tr>
CVE<\/td>CVE-2026-118539 (CWE-862, missing authorization)<\/td><\/tr>
Risk rating<\/td>Highly critical, 21\/25<\/td><\/tr>
Exploitation<\/td>Drupal: “actively exploited in the wild”<\/td><\/tr>
Affected<\/td>Commerce Core below 2.41, and 3.x below 3.3.13<\/td><\/tr>
Fixed<\/td>8.x-2.41 or 3.3.13<\/td><\/tr>
Login needed?<\/td>No, per BleepingComputer\u2019s reading of the advisory<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

What the flaw does<\/h2>\n\n

The advisory says the module does not sufficiently protect certain routes and entity fields, which leads to an access bypass that “may financially impact the vendor.” Drupal has not published how the flaw is exploited, who is behind the activity, or how many sites have been targeted. Treat any store on an affected version since late October as a candidate for review.<\/p>\n\n

Step 1: update Commerce Core<\/h2>\n\n

Sites on the 3.x branch should move to 3.3.13. Sites on earlier releases should move to 8.x-2.41. With Composer and Drush, a typical 3.x update looks like this (take a database backup first and test on staging where you can):<\/p>\n\n

composer show drupal\/commerce                # current installed version\ncomposer require 'drupal\/commerce:^3.3.13' --with-all-dependencies\ndrush updatedb -y\ndrush cache:rebuild\ncomposer show drupal\/commerce                # confirm 3.3.13 or later<\/code><\/pre>\n\n
Drupal published 38 other contributed-project advisories the same day, including several for Commerce Stripe, Commerce Shipping and Commerce License. Update those too if you run them.<\/p>\n\n
Step 2: audit your orders<\/h2>\n\n
Drupal does not specify what “inconsistencies” look like, so here is a practical checklist from MAG212 CYBER. Cover orders placed or changed since October 28, 2026:<\/p>\n\n