Running a Drupal Commerce store? Assume someone already tried this on you.
Drupal has warned that attackers are actively exploiting a "highly critical" missing-authorization flaw in Commerce Core, tracked as CVE-2026-118539, affecting versions 0.0.0 to 2.41 and 3.0.0 to 3.3.13, according to The Hacker News. Missing authorization means requests that should have been rejected got served instead. So patching stops the next attempt, and tells you nothing about what already went through.
That is the part most teams skip. After the update I'd walk the orders, the price and discount changes, the account and role changes across the exposed window, probably looking for state that no legitimate flow could have produced.
I do security reviews of payment and account flows, and that kind of post-incident audit of order and checkout endpoints takes days, not months. You get cost and timeline within a day.
Patch first. Then, if you want a second pair of eyes on what the exposure touched: https://polycratia.com/c/c2c549d9