Active exploitation in Drupal Commerce Core (CVE-2026-118539): urgent patching for online stores
Drupal has issued a public advisory warning that a critical flaw in the Commerce Core module is being actively exploited, placing online stores at risk of unauthorized changes to orders and other store data. Published on October 28, 2026, the advisory identifies missing access checks in routes and entity fields that could let attackers reach functions or modify data they should not control. Drupal assigned the issue a high risk…