What CERT-BUND Published About CVE-2026-96361 and What the Record Leaves Open

Vulnerability overview

CVE-2026-96361 appears in WID-SEC-2026-3554, a CERT-BUND advisory published on 23 September 2026 and rated high risk. The record lists 36 identifiers from CVE-2026-96355 to CVE-2026-96398 and names 16 contributed Drupal projects.
Reading an advisory well means separating the published facts from the gaps, and this record has both.

Mechanism and exploitation conditions

The published facts are specific. The transport is HTTP, the issues are remotely exploitable, patches exist, and the outcome classes are arbitrary code execution, extended privileges, bypass of security measures, data manipulation or disclosure, and cross-site scripting.
The gaps are equally specific. The record does not map each identifier to a project, and it does not describe the defect behind CVE-2026-96361. It also does not assign a separate CVSS vector per identifier; the scoring is recorded at batch level.
That distinction matters for anyone writing an exposure rule. The advisory supports "does this site run an affected module" and does not support a fingerprint for a specific flaw.

Impact

The record's impact estimate is unambiguous at batch level. Damage and probability are both 4 out of 4, the risk rating is high, and the CVSS v3.1 scores are 9.8 base and 8.5 temporal.

Affected products and scope

The 16 named projects each have a fixed release: Webform 6.2.12 and 6.3.1, Webform REST 4.2.1, Cloud 7.0.1, Project Browser 2.0.3 and 2.1.5, Commerce Decoupled Checkout 1.8.0, Mermaid Diagram Field 1.0.9, CookieCuttr 2.0.3, REST & JSON API Authentication 3.2.0, Stop administrator login 1.6, Tawk.to Live chat application 3.0.4, Editoria11y Accessibility Checker 2.2.23 and 3.0.9, AI CKEditor 1.4.3, Combined image style 1.0.7, CSS Usage Analyzer 1.0.2, Smart Content 3.2.1, and Diba carousel slider 3.0.2. Core is excluded.

Exposure context

A ZoomEye query for app="Drupal" returned 436,344 assets on 26 September 2026. That count describes the indexed Drupal population, and the record itself does not connect those assets to the listed modules. A companion query for vul.cve="CVE-2026-96361" returned 0.

Remediation and mitigations

Use the published facts to drive the update and stop where the record stops. Confirm which of the 16 projects you run, apply the matching fixed release, and verify the version. Do not build detection logic that depends on a defect description the advisory does not provide.
Track the revision number. CERT-BUND collected this as revision 1, its initial version, and updates land in the same record rather than a new one. Rechecking the revision is the cheapest way to learn whether the gaps have been filled.

References

• CERT-BUND advisory WID-SEC-2026-3554, revision 1, published 23 September 2026
• CERT-BUND structured record for WID-SEC-2026-3554, damage and probability 4 of 4, CVSS v3.1 base 9.8 and temporal 8.5
• ZoomEye search app="Drupal", executed 26 September 2026, exact count 436344