Critical Drupal Commerce Core Flaw Actively Exploited

A critical authorization bypass vulnerability, CVE-2026-118539, in Drupal's Commerce Core is currently being actively exploited. This flaw affects Commerce Core versions 0.0.0 to 2.41 and 3.0.0 to 3.3.13, potentially leading to financial losses for vendors due to inadequate protection of specific routes and entity fields. Users are strongly advised to update to Commerce Core 3.3.13 or 8.x-2.41 immediately to mitigate the risk.