Drupal Checkout Bypass Under Active Exploitation

Drupal says attackers are exploiting CVE-2026-118539, an authorization bypass in Commerce Core that may let unauthenticated users alter store orders. Upgrade to 3.3.13 or 8.x-2.41 and audit orders for inconsistencies.