Agency Patch Workflows for CVE-2026-96365: Coordinating 16 Module Updates Across Client Sites
Vulnerability overview
WID-SEC-2026-3554, published by CERT-BUND on 23 September 2026 and rated high risk, contains CVE-2026-96365 among 36 identifiers from CVE-2026-96355 to CVE-2026-96398. It covers contributed Drupal projects, so the remediation unit is the module, not the platform. Agencies running many client sites face the same 16-project question multiplied by their portfolio.
Mechanism and exploitation conditions
The record describes remote exploitation with outcome classes covering arbitrary code execution, extended privileges, bypass of security measures, data manipulation or disclosure, and cross-site scripting and confirms patches exist. It does not map each identifier to a defect. The practical precondition is an enabled affected module on a reachable site; the exploitation mechanics for CVE-2026-96365 specifically are not published.
Impact
CERT-BUND scores probability and damage at 4 out of 4, with a CVSS v3.1 base score of 9.8 and a temporal score of 8.5. For a multi-site operator the aggregate exposure matters: a module present on a minority of sites still creates work, and the update window has to be scheduled per site rather than per module.
Affected products and scope
The affected projects and their fixed releases are Webform 6.2.12 and 6.3.1, Webform REST 4.2.1, Cloud 7.0.1, Project Browser 2.0.3 and 2.1.5, Commerce Decoupled Checkout 1.8.0, Mermaid Diagram Field 1.0.9, CookieCuttr 2.0.3, REST & JSON API Authentication 3.2.0, Stop administrator login 1.6, Tawk.to Live chat application 3.0.4, Editoria11y Accessibility Checker 2.2.23 and 3.0.9, AI CKEditor 1.4.3, Combined image style 1.0.7, CSS Usage Analyzer 1.0.2, Smart Content 3.2.1, and Diba carousel slider 3.0.2.
Exposure context
ZoomEye returned 436403 assets for app="Drupal" on 27 September 2026, a global measure rather than a per-portfolio one. The companion query vul.cve="CVE-2026-96365" returned 0. For an agency, the useful inventory is the internal one.
Remediation and mitigations
Sequence the update around testing capacity. Group client sites by the modules they share, so one test pass covers several sites, then apply the fixed release per branch. Remove modules that no client uses any more, because an unused module is a fixed cost with no benefit. Keep a per-site record of the module versions after the window closes, so the next advisory can be answered from records rather than rediscovery.
References
- CERT-BUND advisory WID-SEC-2026-3554, published 23 September 2026: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3554
- CERT-BUND structured record for WID-SEC-2026-3554, 16 projects and 19 fixed releases: https://wid.cert-bund.de/content/public/content/3f0df5d6-5291-41b3-92f2-0c016281c91f
- ZoomEye search app="Drupal", executed 27 September 2026, exact count 436403: https://www.zoomeye.ai/searchResult?q=YXBwPSJEcnVwYWwi
