Back

Drupal Says Commerce Core Flaw Is Being Exploited

lite News Desk 1 min read

A vulnerability in Drupal Commerce Core is under active exploitation, according to Drupal’s security advisory SA-CONTRIB-2026-254, dated October 28, 2026. The advisory identifies the access-bypass flaw as CVE-2026-118539 and assigns it a highly critical classification, with a security-risk score of 21 out of 25.

Commerce Core supports sales of goods and services using a cart and checkout form, as well as sales through applications linked by APIs, according to Drupal. The advisory describes inadequate protection of some routes and entity fields. It says the resulting access bypass may have financial consequences for a vendor.

The affected releases fall into two groups in Drupal’s advisory: Commerce Core versions below 2.41, and the range beginning at 3.0.0 and ending before 3.3.13. The latter boundary excludes 3.3.13 from the affected versions listed.

The Canadian Centre for Cyber Security also addressed the vulnerability in advisory AV26-1105, issued on October 30, 2026. The agency said open-source reporting indicated that the Commerce Core flaw was being exploited.

For sites running Commerce Core’s 3.x series, Drupal identifies version 3.3.13 as the update to install. Its guidance directs sites using an earlier version to 8.x-2.41. Alongside those updates, Drupal recommends reviewing orders to identify inconsistencies.

* This article is based on publicly available information at the time of writing.

More from Cybersecurity

  1. Apple says the reported exploitation was extremely sophisticated and involved selected targets using iOS versions earlier than iOS 27.

  2. The flaw affects Brotli data processed by Node.js’s zlib module, with crashes, memory disclosure or code execution possible for attacker-supplied input.

  3. A cyber incident impacted services in Neshoba County, with email and website disruptions reported, according to company updates.

  4. A cyberattack began on 13 October 2026, targeting over 100 Azerbaijani state domains, disrupting government online resources, according to CERT.

  5. Regulators are increasing scrutiny on AI risks in banking. Compliance deadlines for cyber threats are set for October 2026, according to reports.