Drupal Commerce Core critical access bypass exploited in wild

Fri, 30 Oct 2026 17:01:08 +0000

Engineer — Act: Drupal itself has confirmed active exploitation of this critical access bypass in Commerce Core — patch to the fixed version immediately if you run any Drupal e-commerce sites; check for signs of unauthorized access to orders or admin functions.
SOC/IR — Plan: Active exploitation is confirmed but the item provides no IOCs or ATT&CK-mappable TTPs; build or tune web-application detections for abnormal access patterns on Drupal Commerce endpoints and review web server logs back to patch disclosure date.
Leader — Plan: Verify whether Drupal Commerce is in your environment or any third-party vendor’s stack; active exploitation of an e-commerce access-bypass raises customer/payment-data exposure risk that may require notification review if compromise is found.

Access-Bypass on CuraSec