Drupal Commerce Core CVE-2026-118539: Active Exploitation of Unauthenticated Access Bypass

1. Basic Information

• Article Name: Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254
• Published By: Drupal Security Team
• Publication Date: 2026-10-28
• Original Source: Drupal Security Team
• Related Source: BleepingComputer
• Related Malware: None specified
• Related Threat Actor: None specified
• Related CVE: CVE-2026-118539
• Related Product: Drupal Commerce Core
• Severity: Critical

2. Quick Summary

CVE-2026-118539 involves insufficient route and entity field authorization in Drupal Commerce Core, allowing unauthenticated attackers to manipulate commerce data. Active exploitation has been reported, and Drupal urges updates and order audits.

3. Attack Flow

Pre-Authentication Access Bypass

The following estimated flow is based on the published advisory. Specific exploitation requests, target fields, and operation sequences have not been publicly disclosed.

1. An attacker sends a crafted request to a published Commerce Core route or API.
2. The request bypasses insufficient access checks to reach protected entity fields.
3. The attacker makes unauthorized modifications to commerce data or orders.

4. Attacker Position and Execution Location

• An unauthenticated attacker with network reachability from the internet to the Drupal Commerce endpoint.

5. Victim and Administrator Perspective

Victims

• May observe discrepancies in order details, amounts, statuses, or billing.

Administrators

• Unauthorized activity may blend in with normal web requests and order or entity update logs.

6. Success and Failure Conditions

Success Conditions

• A vulnerable version of Commerce Core is enabled, and the target route is reachable from external networks.
• Successful manipulation of target entity fields following the access bypass.

Failure Conditions and Mitigations

• Update versions 2.x and earlier to 8.x-2.41, and version 3.x series to 3.3.13 or later.
• WAFs and additional authentication are supplementary controls and do not replace module updates and order audits.

7. Impact of Successful Exploitation

• Unauthorized modification of orders or commerce data.
• Financial impact, fraud, and increased customer support overhead.

8. Observable Logs

• Email: None specified
• Proxy / SWG / DNS: Abnormal requests to Commerce APIs or routes, with unusual methods or parameters.
• Endpoint / EDR: Anomalies in web servers and PHP processes are not mandatory. Verify file changes separately.
• Identity / IdP: Unauthenticated sessions or order operations involving suspicious accounts.
• SaaS / Cloud: Discrepancies between transactions on the payment provider side and Drupal orders.
• Network: Route reconnaissance, order ID enumeration, and abnormal update requests from the same source.

9. Attack Success Determination

• Attack Attempt Observed (Success Unconfirmed): Criteria: The arrival of suspicious requests does not prove that order modifications were successful. Verify consistency against databases, order history, and payment records. (Scope: Drupal Commerce)

10. Investigation Playbook

• Trigger: CVE-2026-118539 reconnaissance, order discrepancies, Drupal advisory.
• Initial Checks: Check module versions, public routes, log retention, and payment integrations.
• Endpoint: Preserve web access logs, Drupal logs, database audits, and file integrity.
• Identity / Cloud: Verify account, session, payment provider, and API token activities.
• Follow-on: Investigate potential secondary compromises such as unauthorized orders, refunds, customer data access, or web shells.
• Containment: Update modules, restrict unnecessary routes, put affected orders on hold, and handle customer communications.
• Classification: Categorize findings into request arrival, access bypass, entity modification, and financial impact.

11. Defense and Detection Ideas

• Single Event: Alert on updates to protected entities or orders caused by unauthenticated requests.
• Time-Series Correlation: Correlate chains from route enumeration to order ID harvesting, updates, and payment discrepancies.
• Hunting: Reconcile order change history from the pre-patch period against payment records.
• Logging Gap: Lack of entity field-level audits makes success determination difficult.
• Priority Controls: Prioritize immediate patching, order audits, minimization of public routes, and database audits.

12. Facts, Inferences, and Hypotheses

Facts

• Drupal states that certain routes and entity fields in Commerce Core lack proper access control, allowing unauthenticated users to perform access bypasses.
• Affected versions are Commerce Core releases earlier than 8.x-2.41, and releases from 3.0.0 up to but not including 3.3.13. The fixed releases themselves are not included.
• Fixed versions are 8.x-2.41 and 3.3.13.
• Drupal has confirmed active exploitation and urges users to audit orders after updating.

Inference

• Unauthorized order modifications and tampering with amounts or statuses can lead to financial loss or fraud on commerce platforms, although specific exploit requests and victim counts cannot be determined solely from the public advisory.

Hypotheses

No additional hypotheses. Unverified items are listed in "Unknowns and Limitations".

13. MITRE ATT&CK Mapping

14. Unknowns and Limitations

• Specific exploit requests, threat actors, targets, incident counts, and modified fields have not been publicly disclosed.

15. Impact on SOCs and Organizations

Organizations operating Drupal Commerce should update the 3.x series to 3.3.13 or later, or earlier series to 8.x-2.41. Review historical requests to public APIs and routes, and audit orders for inconsistencies in pricing, status, ownership, refunds, and other details.

16. Summary by Role

• SOC: Correlate suspicious requests with order modifications, separating contact attempts from successful tampering.
• Administrators: Update Commerce Core to fixed versions and audit orders.
• Users: Contact support if any inconsistencies are found in order history or billing.