Drupal's security team warned that attackers are actively exploiting CVE-2026-118539, an access-bypass vulnerability in the Commerce Core module. Insufficient protection of routes and entity fields could allow unauthorized changes with financial consequences for merchants. E-commerce operators may face fraudulent or inconsistent orders. Applying a patch alone may not reveal changes attackers already made. Upgrade Commerce Core 3.x to 3.3.13 or the older supported branch to 8.x-2.41, then audit orders for inconsistencies. Drupal explicitly identifies exploitation in the wild. The advisory does not establish how many stores have been compromised.   submitted by   /u/BTC-brother2018 [link]   [comments]