Drupal Commerce Core authorization bypass actively exploited

Threat actors are actively exploiting CVE-2026-118539, a critical missing authorization flaw in Drupal Commerce Core. The vulnerability affects versions 0.0.0 to 2.41 and 3.0.0 to 3.3.13, allowing unauthorized actions in the shopping cart and e-commerce functionality. Organizations running affected Drupal Commerce versions should patch immediately. Monitor for suspicious account activity and unauthorized transactions.