Critical Drupal Commerce Core flaw is being exploited in attacks

SecurityWeek reports Drupal has confirmed active exploitation of CVE-2026-118539, an access bypass in Commerce Core, a module used on more than 42,000 sites. Unauthenticated attackers can exploit the flaw regardless of the module’s configuration. Drupal urges store owners to update to version 3.3.13 on the 3.x branch or 8.x-2.41 for earlier releases, then review orders for inconsistencies. It has not said how many sites were targeted.