Security AlertCritical
Drupal fixes actively exploited Commerce Core access bypass
Oct 30, 2026 · Summarized by Fundy Tech from 2 sources
The 30-second version
Drupal says attackers are exploiting a critical Commerce Core flaw. Admins should update right away and check orders for unusual changes.
Key points
- CVE-2026-118539 affects Commerce Core versions 0.0.0-2.41 and 3.0.0-3.3.13.
- Drupal says the flaw is actively exploited in the wild.
- Admins should upgrade to Commerce Core 3.3.13 or 8.x-2.41 and review orders.
Why it matters
If your business runs Drupal Commerce, this could affect sales and order integrity. Fast patching helps reduce the risk of unauthorised access and possible financial loss.
Who’s affected: Drupal Commerce Core sites
What to do
- Update Drupal Commerce Core now.
- Audit orders for inconsistencies.
- Check whether your site uses affected versions.
Vulnerability IDs
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.