CVE-2026-118539 in Drupal Commerce Core: Patch and Historical Audit Required

On October 28, 2026, the Drupal Security Team published advisory SA-CONTRIB-2026-254 for a missing authorization vulnerability in the Commerce Core module. The flaw, cataloged as CVE-2026-118539 and classified CWE-862, is actively exploited by unauthenticated actors to alter orders and evade payments, causing financial impact to merchants. The module runs on more than 42,000 active sites, including Fortune 500 companies and research universities.

Verified Facts

Identification and classification. CVE-2026-118539 is recorded on NVD as Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing with CWE-862. The CVE.org record confirms affected versions and the developers responsible for the fix.

Risk assessment. The Drupal Security Team assigned the maximum score of 21/25, above the 20 threshold that defines Highly critical. The vector AC:None/A:None indicates access without authentication or prior privileges; E:Exploit confirms active exploitation; TD:All indicates impact on all data types.

Attack surface. According to Drupal statistics cited by BleepingComputer, the Commerce Core module is installed on more than 42,000 sites. The source does not specify how many of these are actually vulnerable under current configuration.

Confirmed exploit cases. Centarro, the module's commercial maintainer, documented two reports of fraudulent order attempts. According to Rescana, which relays Centarro's testimony, attackers attempted to have orders accepted without full payment. Reports included orders placed at obviously incorrect prices, such as $0.01. These are the only confirmed cases; there is no evidence of broader abuse.

Current threat status. Rescana reports no evidence of scripted or large-scale abuse as of October 29, 2026. The CVE does not appear in the CISA Known Exploited Vulnerabilities catalog as of version 2026.10.29.

Analysis: How the Bypass Works

The Commerce Core module manages the e-commerce lifecycle on Drupal: carts, checkout, orders, payments, and API integrations. According to the official advisory, cited by The Hacker News, the module doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor.

Rescana's technical analysis, the sole primary structured source with exploit-level detail, maps four types of order tampering. Rescana notes the vulnerability affects both traditional full-stack architectures and implementations exposing Commerce Core via JSON:API. For sites with JSON:API enabled, the vulnerability window is longer: it dates back to May 2020 (version 8.x-2.18) versus June 2021 (version 8.x-2.25) for other installations. The vector requires no valid credentials: the Drupal score's AC:None and A:None fields confirm accessibility for unauthenticated actors.

Source limitations. Detailed technical analysis relies primarily on Rescana. Drupal and Centarro have not published request-level details or complete exploit technical specifications. Rescana mentions SQL queries as a historical audit tool, but notes results require judgment and expertise, including legitimate staff actions.

"The module doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor. This vulnerability is being actively exploited in the wild." — Advisory Drupal SA-CONTRIB-2026-254 (via The Hacker News)

Temporal Context: Exposure Window Since 2020

The significant finding from Centarro's analysis concerns the temporal exposure window. For sites using JSON:API with Commerce Core, the vulnerability is theoretically exploitable from version 8.x-2.18, released in May 2020. For all other installations, the threshold shifts to June 2021 with version 8.x-2.25. Four to five years of theoretical exposure, depending on configuration.

The Drupal score of 21/25 reflects the combination of total accessibility, economic impact, and proven exploitability. The lack of a standard CVSS score, assigned by neither Drupal nor NVD (still in Received state), limits comparable risk assessment for security teams.

Immediate Actions

Priority actions emerge from official sources and Rescana's analysis:

• Update immediately to version 8.x-2.41 (previous branch) or 3.3.13 (current branch), the only releases that fix the vulnerability per the Drupal advisory and official CVE records.
• Audit historical orders for anomalies: the Drupal advisory explicitly recommends verifying past order consistency, given retroactive exploitability. Rescana suggests SQL queries as a tool, with the caveat that results require expertise and judgment to distinguish malicious actions from legitimate staff operations.
• Verify JSON:API configuration: sites with this interface enabled have a longer vulnerability window (since 2020) and require particular attention during audit.

What We Know and Don't Know

We know: the vulnerability is real, actively exploited, with two confirmed cases of order manipulation. Patches are available. The Drupal score is 21/25. The theoretical exposure window begins in 2020-2021.

We don't know: the exact number of compromised sites; the economic magnitude of damage suffered by the two reporting merchants; whether the vulnerability was exploited as a zero-day before October 28, 2026; request-level technical details; presence of public exploit code. No official source has published a CVSS score.

The historical audit recommendation comes from the Drupal advisory, not from a specific verification timeline. Security teams must assess audit depth based on their operational context and the JSON:API activation date, if applicable.

Editorial Closing

The CVE-2026-118539 case illustrates the limits of risk assessment when official sources provide advisories without complete technical details and a single independent vendor (Rescana) offers structured analysis. The combination of unauthenticated access, financial flows, and a multi-year exposure window makes the vulnerability critical for the Drupal community, but confirmed data stops at two exploit cases. The absence of scale evidence does not authorize minimization, nor does it justify escalation unsupported by verified facts.

Sources

• thehackernews.com
• bleepingcomputer.com
• securityweek.com
• rescana.com
• nvd.nist.gov
• cve.org
• securityweek.com