Reading the 9.8 Score for CVE-2026-96357 Correctly

One score, thirty-six identifiers

CERT-BUND records a CVSS v3.1 base score of 9.8 and a temporal score of 8.5 for advisory WID-SEC-2026-3554. That advisory contains 36 CVE identifiers, including CVE-2026-96357. The score describes the advisory, and reading it as a per-identifier rating is the most common mistake with this record.

Vulnerability overview

The advisory was published on 23 September 2026 and rated high risk. It covers Drupal contributed modules and records that fixes exist.

What the score does say

The base score reflects the worst credible impact in the batch under the shared impact statement, which covers arbitrary code execution, privilege escalation, security bypass, data disclosure and cross-site scripting. The temporal score adjusts for exploit maturity and remediation availability at assessment time.

Mechanism and exploitation conditions

Because the impact statement is shared, a 9.8 reading does not establish that CVE-2026-96357 is itself remotely exploitable without authentication. CERT-BUND does mark the batch remotely exploitable, and that flag applies to the advisory.

Impact and scope

The practical consequence is that prioritisation has to come from the installed module, not from the score alone. The structured record lists 16 contributed projects and 19 affected version ranges, and the per-project advisory is where a narrower severity would live.

Exposure context

ZoomEye returned 436263 instances for app="Drupal" on 25 September 2026; the identifier query returned nothing. Exposure describes reachable product instances and is not a severity measure.

Remediation and mitigations

Treat the score as a reason to act quickly on installed affected modules, then record the per-project advisory and fixed version. Where a compliance record needs a per-identifier severity, state that the batch record supplies only an advisory-level score.