Security ·
Drupal Commerce: critical flaw CVE-2026-118539 is being exploited to place fake orders
On 28 October 2026 Drupal rated a flaw in the Commerce Core module highly critical and confirmed it is being actively exploited. According to a security analysis, attackers need no account and store orders are the target.
The Drupal security team published advisory SA-CONTRIB-2026-254 on 28 October 2026 for the Commerce Core module, which powers many online stores built on Drupal. The flaw, tracked as CVE-2026-118539, received the top rating of highly critical (21 out of 25) and Drupal states plainly that it is already exploited in the wild.
According to the advisory, the module does not sufficiently protect certain routes and entity fields, which creates an access bypass that can cost the vendor money. Security firm Rescana reads Drupal's scoring as meaning no account is needed, and describes two reports of attempts to place fraudulent orders without full payment, including at prices such as $0.01. Drupal itself did not detail the attack method or the scale of the campaign.
Affected are Commerce Core versions older than 2.41 and from 3.0.0 up to 3.3.12. The fix is version 3.3.13 on the 3.x branch and 8.x-2.41 on the older branch. Rescana reports that Drupal lists no workaround that replaces the upgrade.
The vendor guidance has two parts: update the module and audit past orders for inconsistencies. Centarro, the developer of Drupal Commerce, gives the same advice. Patching alone does not undo an attack that happened before it. A fraudulent order can end in goods being shipped, or in errors in accounting and stock.
What it means for companies
If you run Drupal Commerce, check the module version today, deploy 3.3.13 or 8.x-2.41 and review orders from recent weeks: look for orders at unusually low prices and for paid orders without a matching payment at the bank or payment gateway. Regular patching and watching for advisories like this is part of our website maintenance, and a wider store review is part of our cyber security work. Routine reconciliation of orders against payments can also be handled by AI agents for e-commerce, which pass unusual cases to a person for approval. Prahapp, the AI division of Buinsoft Technology in Prague, will build a free prototype for you.