Running a Drupal store? Stop and check your Commerce Core version.
The details
Drupal rated CVE-2026-118539 highly critical. It’s a missing-authorization flaw that unauthenticated attackers can use to get around access checks on certain routes and entity fields, which “may financially impact the vendor.” It affects Commerce Core 0.0.0 through 2.41 and 3.0.0 through 3.3.13, and Drupal says it’s being exploited. Per BleepingComputer, the advice is to upgrade right away (3.3.13 on 3.x or 8.x-2.41 on older branches, per Drupal’s advisory) and audit orders for anything odd. Commerce Core runs on more than 42,000 sites. It’s Drupal’s third serious warning in a few weeks, after the two RCE fixes earlier this month.
My take
Check the official advisory for the exact fixed version, update, then look through recent orders for prices or statuses that don’t add up.
God Bless, and Needs Garlic!
