Drupal Warns of Critical Commerce Flaw

Drupal warns admins to patch a critical access bypass vulnerability tracked as CVE-2026-118539 affecting Commerce Core versions 0.0.0 through 2.41 and 3.0.0 through 3.3.13. The module enables selling goods via shopping carts and is used by more than 42,000 websites including Fortune 500 companies and research universities. US CISA ordered federal agencies to patch within three days.