The advisory

Check the Commerce branch you actually run

Drupal's advisory describes an access-bypass flaw in Commerce Core and says it has been exploited. The affected versions are earlier than 2.41 on the 2.x branch and 3.0.0 through versions before 3.3.13 on the 3.x branch. Drupal directs operators to 8.x-2.41 or 3.3.13, respectively.

Scope the claim

The advisory confirms exploitation but does not establish that every affected shop was accessed or identify a universal campaign. Check your own logs and records before making an incident declaration.

Defender workflow

Fix the code and reconcile the business record

  1. 1

    Inventory installations. Find production, staging and less-visible storefronts using Commerce Core. Record the running module version, not only the package-lock entry.

  2. 2

    Apply the branch fix. Update to the Drupal-recommended fixed version for the installed branch and verify the deployed site after caches and workers have refreshed.

  3. 3

    Review affected activity. Examine application and edge logs, order access and order changes during the exposure window. Reconcile suspicious records with fulfilment, payment and customer-service evidence.

Defender note

A successful upgrade does not reconcile an order

The useful closure record says which stores were exposed, when they were fixed, and whether order records were checked for unexpected access or changes. Keep technical and financial review owners in the same conversation.