On Drupal Commerce, patching is not the whole job. The flaw is already being exploited, so someone may have touched orders or prices before you updated. The Hacker News reports Drupal rating CVE-2026-118539 highly critical in Commerce Core up to 2.41 and 3.0.0-3.3.13. Patch today, then audit order, pricing and account endpoints for abuse that already happened. We do that review on payment and account flows: send us your version and we will scope it within a day.
Was this useful?