Drupal Commerce CVE-2026-118539 is exploited: patch, audit orders

Your store can be patched and still be wrong. Drupal Commerce Core CVE-2026-118539 is an access bypass that attackers are using right now. Drupal's security team rates it highly critical, 21 out of 25, and says no login is needed. The fix shipped on October 28. But the advisory tells you to do one more thing after the update: audit your orders. If you run a Drupal store and haven't touched it since October, this is your weekend job.

What actually happened

• The flaw. Commerce Core is the module that gives Drupal a cart, a checkout and order APIs. Per the advisory quoted by BleepingComputer, the module "doesn't sufficiently protect certain routes and entity fields." Drupal says the result "may financially impact the vendor." In plain words: someone can change order data they should not reach.
• Who's affected. Per SecurityWeek, 3.x releases before 3.3.13 and older releases before 8.x-2.41. Drupal's own statistics show the module on more than 42,000 sites.
• Exploitation. Drupal confirms attacks in the wild. It hasn't said how the bug is used, who is behind it, or how many stores were hit.
• It wasn't alone. The same October 28 batch had 38 more advisories. SecurityWeek says one critical bug let Commerce orders paid through Stripe be marked as paid with no payment. So update every Commerce module, not just core.

Why it matters for your business

A defaced homepage gets noticed. A changed order total does not. Your fulfillment team ships what the order says, and an order bug turns into lost stock and lost money with no alarm. That's why the audit matters more than usual.

Do it in this order:

1. Check your version. Run composer show drupal/commerce. If you're under 3.3.13 on 3.x, or under 8.x-2.41 on the old branch, you're exposed.
2. Update everything Commerce. composer update "drupal/commerce*" --with-all-dependencies, then drush updatedb and drush cache:rebuild. Test checkout on staging first if you have it. Don't wait on staging if you don't.
3. Audit orders since October 28, and earlier if you can. Drupal hasn't said whether this was used before the fix. Compare each order's total with the payments recorded against it. Flag orders marked paid or completed with no matching charge in your payment dashboard. Flag orders whose items or prices changed after checkout.
4. Hold what looks wrong. Pause fulfillment on flagged orders until a person checks them.

Sources: BleepingComputer, SecurityWeek.