Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw

Drupal has warned that threat actors are exploiting a highly critical security flaw in its Commerce Core component, The Hacker News reports. The vulnerability, tracked as CVE-2026-118539, is a missing-authorization flaw affecting Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13.