Drupal has confirmed active exploitation of CVE-2026-118539, a highly critical Drupal Commerce access bypass that lets requests reach store routes and data they should never touch. Updating the module closes the hole, but you also need to check whether anyone changed your orders, prices or checkout settings while it was open.
