Drupal Commerce Core Vulnerability Exploited

Drupal urges online store owners to patch a critical access bypass vulnerability tracked as CVE-2026-118539, which affects more than 42,000 sites. The security team assigned a risk score of 21 out of 25, noting unauthenticated attackers can exploit the flaw. Administrators must update to fixed versions 3.3.13 or 8.x-2.41 and audit orders for inconsistencies immediately.