---
title: Drupal Commerce Core access bypass (CVE-2026-118539) is being exploited in the wild; update to 3.3.13 or 8.x-2.41 and audit your orders | ctxsec
url: https://ctxsec.com/items/drupal-commerce-core-cve-2026-118539-access-bypass-exploited
description: ""
status: "official (Drupal Security Team advisory SA-CONTRIB-2026-254, Oct 28); actively exploited per the advisory"
published: 2026-10-29
---

> 

[← Cybersecurity News](/news) · [markdown](/items/drupal-commerce-core-cve-2026-118539-access-bypass-exploited.md)

official (Drupal Security Team advisory SA-CONTRIB-2026-254, Oct 28); actively exploited per the advisory

2026-10-29

### Drupal Commerce Core access bypass (CVE-2026-118539) is being exploited in the wild; update to 3.3.13 or 8.x-2.41 and audit your orders

The Drupal Security Team rates this **Highly critical** (21/25). Commerce Core does not sufficiently protect certain routes and entity fields, which allows an access bypass that "may financially impact the vendor." The advisory states that the flaw **is being actively exploited in the wild**. No authentication or special conditions are listed as required.

- **Affected:** Commerce Core below 8.x-2.41, and 3.x below 3.3.13.
- **Fixed:** 3.3.13 (3.x) and 8.x-2.41 (2.x).

**What to do:** update now. Because exploitation is confirmed, the Drupal team tells sites to **audit orders for inconsistencies**, such as prices, totals, payment states or order states that do not match what customers paid. Compare order totals with your payment provider's settlement records for the period before you patched.

Sources: [Drupal.org: Commerce Core, Highly critical, Access bypass, SA-CONTRIB-2026-254 (Oct 28)](https://www.drupal.org/sa-contrib-2026-254)