The Drupal Security Team rates SA-CONTRIB-2026-254, an access bypass in the Commerce Core module, “Highly critical” and says the flaw is being actively exploited.
The advisory is dated October 28 and covers CVE-2026-118539. Drupal says the module “doesn’t sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor”. Its risk score is 21 of 25. The advisory does not say how many sites were hit or who is behind the exploitation.
Two version ranges are affected: Commerce Core releases below 2.41, and releases from 3.0.0 below 3.3.13. Sites on the 3.x branch should move to Commerce Core 3.3.13. Sites on an earlier version should move to 8.x-2.41.
Patching is only part of the response. The advisory adds that “Sites should audit their orders for inconsistencies as this vulnerability is being actively exploited.” An access bypass on order routes and fields leaves no crash or alert behind, so the audit is the step that shows whether a store was already affected before the update landed.
The advisory is filed as a contributed-module notice, so it sits outside Drupal core release announcements. In our reading, teams that track only core updates are the ones likely to miss it, and a store should confirm its Commerce Core version today rather than wait for a scheduled maintenance window. Our opinion on exposure inventories argues that knowing which modules you run decides the first hour after an advisory, and our brief on the PHP advisory for CVE-2026-115560 covers another web-stack notice from this month.
Source: Drupal.org, SA-CONTRIB-2026-254
