Drupal's Commerce Core CVE is being actively exploited right now — and it shipped alongside an RCE
Drupal's security advisory queue runs in batches, and most weeks the headline is "patch when convenient." The October 28, 2026 batch (SA-CONTRIB-2026-254 through -292) isn't that week. Two of its advisories deserve immediate attention, for different reasons: one is rated Highly Critical and is confirmed being exploited right now; the other is a Critical remote code execution hiding behind what looks like a narrow permission requirement.
Commerce Core: active exploitation, confirmed
SA-CONTRIB-2026-254 affects Drupal Commerce Core — the 8.x-2.x branch before 2.41, and 3.0.0 up to before 3.3.13. It's rated 21/25, "Highly critical," and has been assigned CVE-2026-118539. The root cause: certain routes and entity fields don't have adequate access protection, allowing those access controls to be bypassed in ways the advisory describes as capable of causing direct financial harm to the site operator. The fix is a straightforward version bump — 3.3.13 for 3.x sites, 8.x-2.41 for the older branch — but the detail that changes the urgency calculus entirely is this: Drupal's Security Team states outright that the vulnerability is being actively exploited in the wild, and recommends site owners audit their orders for inconsistencies, not just patch and move on. An access-bypass bug on an e-commerce module with live exploitation and a recommendation to audit past transactions is about as unambiguous a "patch today, then check your order history" as a Drupal advisory gets.
Single Content Sync: deserialization RCE behind one permission
The same batch includes SA-CONTRIB-2026-275, affecting Single Content Sync before 1.4.19, fixed in 1.4.19, rated 17/25 ("Critical") with CVE-2026-118562 assigned. Single Content Sync imports and exports content via files; the vulnerability is that a crafted import file triggers unsafe deserialization on the way in, which the advisory confirms leads to remote code execution. The module itself gates this behind the "import single content" permission, which meaningfully narrows who can trigger it — this isn't reachable by an anonymous visitor — but RCE gated behind a single content-editor-level permission is still RCE behind a permission a normal editorial workflow would plausibly grant. If any role beyond trusted admins has "import single content," this is not a "patch next maintenance window" bug.
The rest of the batch, briefly
The same October 28 release also carried critical-rated XSS, CSRF, and authentication-bypass advisories for OAuth2 Token Manager, OAuth Login, Stage File Proxy, a Signature Pad widget module, and the AI module — no Drupal core advisories in this particular batch, all contrib. If you're running any of those alongside Commerce or Single Content Sync, this week's maintenance window is not optional.
Why these two together matter
Pairing an actively-exploited access bypass with an RCE in the same disclosure batch is a reminder that "critical" on a Drupal security advisory isn't a uniform label — the Commerce bug needs a response today because it's already happening to someone, while the Content Sync bug needs a response today because of what it would mean if it started. Both outcomes point the same direction: check `composer show` for these two modules specifically, update immediately, and for Commerce sites, don't skip the order audit the Security Team is explicitly recommending.