Drupal Commons 3 and Original Drupal Core Updates
The Commons team has committed to having a new release of commons within a short period after a core or contrib security release so you should just be able to upgrade by following the Commons upgrade procedure.

It's a bit risky to update core or contrib modules inside of a distribution. If you can do it on a test site first, confirm that it's working, and report your problems with the test site to the issue queue then you'll help getting the fully packaged Commons out.