Drupal says CVE-2026-118539, a highly critical access-bypass flaw in Drupal Commerce Core, is being actively exploited in the wild. Updating Drupal core leaves this module untouched. The advisory's version numbers also need a careful second read before you call your shop patched.
