Drupal warns that a highly critical security flaw in its Commerce Core module is being exploited in the wild against online stores. The issue involves an authorization or access bypass, and Drupal urges store operators to audit orders and apply fixes.
Reporting across outlets focuses on Drupal’s advisory and the immediate mitigation message for administrators. SecurityWeek and Bleeping Computer both emphasize that attackers are already using the weakness and that merchants should act by patching and reviewing potentially affected activity.
The Hacker News adds technical specificity, describing the problem as an authorization bypass and naming the tracked issue as CVE-2026-118539. It also outlines affected version ranges for Commerce Core, providing additional context for who may need to update and when the vulnerability appears in releases.
