Detecting and monitoring around CVE-2026-96360

Vulnerability overview

CVE-2026-96360 is a cross-site scripting vulnerability in the Drupal contributed module Webform, documented as SA-CONTRIB-2026-154 and published 2026-September-23. Drupal scores the issue 11 of 25, labelled Moderately critical, with the vector AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon.

The behaviour that is exploitable

Webform uses a JavaScript announcement behaviour to tell assistive technologies about dynamic form updates. The announcement text is not sanitised sufficiently before it is written into the page, so crafted content can be parsed as markup. The advisory describes the consequence as cross-site scripting for users interacting with the affected Webform.

Exploitation conditions

Administrative permissions on the site are required, as recorded by A:Admin, and the target distribution is uncommon. That combination shapes detection: the interesting events are actions by privileged accounts rather than anonymous requests from the internet.

What to monitor

Review audit logs for form and module configuration changes made by administrative accounts, particularly changes that introduce markup into form labels, descriptions, or accessibility settings. Watch for new or modified custom templates that override announcement markup. Track authentication events for administrative users and investigate logins from unexpected locations. Because the vulnerability can be triggered by interaction with a form, unusual script or markup content saved through form-building interfaces is worth alerting on.

Impact

Successful exploitation gives script execution in the session of a user who interacts with the affected form, with confidentiality and integrity effects rated Some and availability unaffected. Where the victim holds administrative permissions, content and configuration changes become possible.

Affected products and scope

The affected project is the Webform contributed module for Drupal, machine name webform. Version boundaries are stated in the individual advisory rather than the listing summary.

Remediation and mitigations

Apply the September 2026 update, confirm the installed version, and clear caches. Reduce administrative accounts, review form editing roles, and remove local overrides that reproduce the unsafe output path. Monitoring complements the patch and does not replace it.

Exposure context

ZoomEye reported 0 results for vul.cve="CVE-2026-96360" and 436368 for app="Drupal" on 2026-09-26. The first figure reflects indexing gaps and the second describes general Drupal visibility, so neither replaces local inventory.