Store operators are being told to patch a highly critical access bypass in the Commerce Core contributed module, then read through their order records, because the flaw is already being used in the wild.
Tracked as CVE-2026-118539, the defect sits in the module that bolts a cart and checkout onto a Drupal site, and Drupal counts it on more than 42,000 sites. Routes and entity fields go under-protected, yielding a bypass with financial consequences for a vendor.
Reviewers there scored the flaw 21 out of 25, with unauthenticated attackers able to reach it however the module is configured. Drupal has given no request pattern, named nobody behind the activity or said how many stores were hit. Whether exploitation began before patches existed is also unanswered.
Fixed releases are 3.3.13 and 8.x-2.41. Anything earlier in the 3.x line, and anything earlier in the 2.x line, needs replacing.
The Commerce fix landed inside a batch of 38 advisories published October 28 across 21 contributed projects, close to a dozen rated critical.
Remote code execution, account takeover and a Stripe-settled Commerce order paid with nothing are among them. The CAPTCHA module drew a moderately critical fix for a form resubmittable without a fresh challenge, and Drupal’s ratings indicate exploit code for it exists, plus proofs of concept for information disclosure bugs in Commerce Core and Media Alias Display.
On October 14, Drupal shipped fixes for two critical remote code execution bugs, CVE-2026-108097 in core’s Field UI module and CVE-2026-108099 in the Entity List module, exploitable only alongside certain contributed modules or custom code, sometimes unauthenticated. May did bring attempts against CVE-2026-9082, an injection flaw rated highly critical that sits in core’s database abstraction API and strikes PostgreSQL-backed sites.
Operators should treat ordering data as potentially altered until reviewed, not simply patched and forgotten.
