Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw
Drupal warned that threat actors are exploiting a "highly critical" missing authorization flaw in its Commerce Core component, tracked as CVE-2026-118539, affecting versions 0.0.0 to 2.41 and 3.0.0 to 3.3.13. Drupal said the module does not sufficiently...