Drupal Commerce CVE-2026-118539 patch — 3.3.13 and 8.x-2.41 stop no-login order tampering

Two days after the patch shipped, it came with an 'under attack' warning. The security team for Drupal, the open-source content management system, says CVE-2026-118539 in Commerce Core, its online-store module, is being exploited in the wild. The advisory is SA-CONTRIB-2026-254, and the risk score is 21 out of 25, rated 'Highly critical'.

The short answer: upgrade to 3.3.13 on the 3.x branch, or 8.x-2.41 on the 2.x branch. Both were released on October 28, 2026. Bringing Drupal core up to date does not fix this module. Commerce Core is what adds carts, checkout and sales to a Drupal site, so a breach turns directly into a problem with orders and money.

1. Patched versions — which one applies to your site

About 30,000 sites are on the 2.x and 3.x branches that need patching. The release also fixes five less severe vulnerabilities. Some sources list the vulnerable range broadly, starting from 0.0.0, so the first step is to confirm your site's exact version. Commerce API, Commerce License, Commerce Shipping and Commerce Stripe also received separate security releases.

Drupal 7 sites are in a harder spot. Drupal 7 has not received security updates since January 5, 2025, so it was left out of this advisory entirely. Why unsupported software is dangerous is explained with the PHP example in "What is end of life (EOL) software?".

2. What is wrong — the door is there, but the lock is missing

Missing authorization means exactly that: the step that asks whether the person making a request is allowed to do this is absent. Order details that should require a login, or fields only an administrator should change, can be reached by someone who is not logged in, simply by requesting the address directly. Drupal has not said which routes and fields are involved, to avoid handing attackers a map.

That is also why Drupal recommends checking orders after updating. If data could be modified, prices, totals or order status may have been changed.

3. Exploited two days after the patch — the window is gone

A writer at ITdaily argued that the gap between patch release and real attacks has effectively vanished, citing AI tools that analyze patches and quickly produce attack code as one reason. A patch shows what was fixed; knowing what was fixed lets attackers target sites that have not patched. The argument is that AI is shrinking that window (this is the writer's opinion, not Drupal's analysis).

The same pattern ran through all of October 2026. PHP2Shell saw attack attempts starting four days before disclosure ("PHP2Shell patch versions"). In the same week, Cisco firewall and GitLab vulnerabilities were added to the CISA exploited list.

4. A checklist for site operators

5. Frequently asked questions

6. What remains and what is unconfirmed

• Evidence of attacks: Active exploitation is Drupal's security team's statement. Some threat-intelligence firms marked the evidence as insufficient, and the flaw is not yet on the CISA list.
• Attack method and damage: Drupal has not disclosed them. The number of affected sites is unknown.
• Regional exposure: How many stores in any given country run Drupal Commerce could not be confirmed.

The largest crypto theft on record, which broke the same day, is covered in "Binance hack of $6.3 billion".