Drupal says CVE-2026-118539, a highly critical access-bypass flaw in Drupal Commerce Core, is being actively exploited in the wild. Updating Drupal core leaves this module untouched. The advisory's version numbers also need a careful second read before you call your shop patched.
Drupal has confirmed active exploitation of CVE-2026-118539, a highly critical Drupal Commerce access bypass that lets requests reach store routes and data they should never touch. Updating the module closes the hole, but you also need to check whether anyone changed your orders, prices or checkout settings while it was open.