Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw

Drupal has warned that threat actors are exploiting a highly critical security flaw in its Commerce Core component The vulnerability tracked as CVE2026118539 CVSS score NA is a case of missing authorization affecting Commerce Core versions from 000 to 241 and from 300 to 3313 This module enables you to sell goods and services to customers through an included shopping cart