Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw

Drupal warned that threat actors are actively exploiting a highly critical authorization bypass flaw in its Commerce Core component, tracked as CVE-2026-118539. The vulnerability affects Commerce Core versions from 0.0.0 to 2.41 and 3.0.0 to 3.3.13. The module enables selling goods and services via an included shopping cart, and missing authorization could allow unauthorized access. Immediate patching is advised.