The facts

  1. SA-CONTRIB-2026-254 describes insufficient protection of certain routes and entity fields, allowing access bypass that may financially harm merchants. Its risk vector lists no authentication requirement. [1]

  2. The official affected-version expression is below 2.41, or3.0.0 through versions before 3.3.13. The named fixed releases are not included in those vulnerable ranges. [1]

  3. Drupal recommends both installing the relevant update and auditing orders because exploitation is occurring. This warning concerns Commerce Core, not every Drupal installation. [1][2]

  4. The advisory rates the issue highly critical at 21/25 on Drupal's risk scale. That is not a CVSS score. [1]

Still unconfirmed

  • The number of affected or compromised merchants, total losses and the identity of attackers are not established in the checked sources.

Sources

References support the numbered facts above. Source checks: 30 Oct 2026, 08:54 UTC.

  1. Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254

    Drupal Security Team · Primary source · 28 Oct 2026

    Actual advisory read. Exact less-than version bounds and fixed releases take precedence over an ambiguous inclusive range in secondary reporting. The advisory confirms exploitation but gives no campaign-size figure.

  2. Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw

    The Hacker News · Reporting · 30 Oct 2026

    Actual report read. Independently operated security newsroom, separate from Drupal; it corroborates the issued warning rather than supplying an independent count of compromised merchants.

Report a factual error