Drupal’s security team says attackers are exploiting CVE-2026-118539, an access-bypass flaw in the Drupal Commerce contributed module. The advisory lists affected 2.x and 3.x releases and provides fixed versions. Operators should use the version ranges in the advisory to determine exposure rather than assuming every Drupal site is affected.
What the advisory confirms
Drupal published SA-CONTRIB-2026-254 on October 28 and marked the issue as actively exploited. On October 29, Centarro, the Drupal Commerce maintainers, reported two cases of attempted fraudulent orders and said they did not believe exploitation had been scripted or spread beyond the initial sites observed. SC Media and SecurityWeek also reported the warning and remediation. The Drupal advisory remains authoritative for affected releases and upgrade instructions.
The issue concerns Drupal Commerce, not the Drupal core installation alone. A site must use an affected Commerce release for this particular vulnerability to apply.
Affected versions and fixes
Drupal lists versions below 2.41 and versions from 3.0.0 up to, but not including, 3.3.13 as affected. The fixes are Drupal Commerce 8.x-2.41 or 3.3.13, depending on the installed branch. Confirm the exact branch and follow the project advisory before upgrading.
Drupal rates the issue 21/25 in its security risk scoring. That score and the active exploitation status support prompt action, but do not reveal how many stores have been attacked or whether a particular store was compromised.
What an access bypass can mean
An access-control defect can let an unauthenticated or insufficiently privileged user reach an operation intended for a more restricted role. The exact preconditions and affected actions are described by Drupal. Do not infer that payment card data or all customer records were stolen solely from the vulnerability notice.
For an online store, unexpected changes to accounts, orders, content, or administrative settings merit investigation. The advisory’s exploitation warning makes it prudent to look for evidence rather than relying only on patching as a complete incident response.
Steps for site operators
Inventory Drupal Commerce versions across production, staging, and less visible installations. Apply the matching fixed release, then confirm the deployed code and dependencies. Drupal specifically advises sites to audit orders for inconsistencies because the flaw is actively exploited. Also review web, application, authentication, and commerce logs for unexpected requests or privilege changes.
If there are signs of exploitation, preserve relevant logs and follow an incident-response process: restrict suspicious accounts, rotate credentials and secrets that may have been exposed, and assess customer-notification obligations based on verified evidence.
What public reporting does not establish
Drupal confirms active exploitation. Centarro reported two cases of attempted fraudulent orders and said that, as of October 29, its maintainers did not believe the activity had been automated or spread beyond the initial sites observed. This is not a complete count of attempts or a guarantee that a particular store was unaffected; review your own orders and logs.
The connection to Soclyde
Unique administrator passwords can reduce credential reuse risks, but they cannot fix an application authorization bug. Soclyde keeps an encrypted vault on users’ devices rather than in a centralized cloud vault operated by Soclyde. Read our guide to local and cloud password storage.
Key points
Drupal reports active exploitation of a version-specific Commerce flaw and publishes fixed releases. Identify the installed branch, update promptly, and investigate logs for evidence of access beyond what the public advisory can establish.
