Drupal's Commerce Core CVE is being actively exploited right now — and it shipped alongside an RCE

SA-CONTRIB-2026-254 (CVE-2026-118539) is an access-bypass flaw in Drupal Commerce that the Security Team says is already being exploited in the wild. The same October 28 advisory batch included an unauthenticated-adjacent deserialization RCE in Single Content Sync — here's what each one actually does and who needs to patch today.