Drupal has patched CVE-2026-118539, an exploited Commerce Core access bypass that may financially impact online store owners.