Critical Drupal Commerce Core Authorization Bypass Flaw Actively Exploited

Drupal has issued a warning regarding a severe authorization bypass vulnerability in the Commerce Core component, tracked as CVE-2026-118539. Threat actors are actively exploiting this flaw affecting versions 0.0.0 through 2.41 and 3.0.0 through 3.3.13. Administrators should immediately apply the released security updates to secure vulnerable e-commerce environments.