Drupal says CVE-2026-118539 is being exploited against 42,000-plus sites, pushing Commerce Core users to patch and review ...
Drupal has patched CVE-2026-118539, an exploited Commerce Core access bypass that may financially impact online store owners.