Attackers actively exploit a critical authorization bypass in Drupal Commerce Core

On October 30, 2026, Drupal warned that CVE-2026-118539, an authorization flaw in the Commerce Core module, is being actively exploited in the wild. Any e-commerce site running Drupal Commerce must move to 3.3.13 or 8.x-2.41 without delay, then audit its orders and prices.