CVE-2026-96357 Exposure Context: What 436263 Drupal Instances Mean

Reading the number

A ZoomEye query for app="Drupal" returned 436263 instances when checked on 25 September 2026. That figure sits alongside CVE-2026-96357 in the same advisory as a measure of how much Drupal surface is observable, not as a vulnerability count.

Vulnerability overview

CVE-2026-96357 is one of 36 identifiers in CERT-BUND advisory WID-SEC-2026-3554, published on 23 September 2026 and rated high risk. The record carries a CVSS v3.1 base score of 9.8 and a temporal score of 8.5, and notes that fixes exist.

Mechanism and exploitation conditions

The advisory supplies one shared impact statement: arbitrary code execution, privilege escalation, security bypass, data tampering and disclosure, and cross-site scripting. It does not attribute a flaw class to any single identifier, so the exposure number cannot be narrowed to the flaw either.

What the exposure figure supports

The count supports a statement about how widely Drupal is deployed and reachable. It does not support a statement that any of those deployments runs an affected contributed module, and it does not indicate patch state.

Affected products and scope

The affected set is 16 contributed projects across 19 version ranges, including Webform, Webform REST, REST & JSON API Authentication, Commerce Decoupled Checkout, Project Browser, Editoria11y Accessibility Checker and others. The CPE data is cpe:/a:drupal:drupal.

The identifier query

The query vul.cve="CVE-2026-96357" returned nothing. A zero result for an identifier-level query is common for newly published identifiers and is not evidence that no affected asset exists.

Remediation and mitigations

Use the exposure figure as context for prioritisation, then work from the version ranges. Update installed affected projects to the fixed releases cited in Drupal advisories sa-contrib-2026-154 through sa-contrib-2026-191 and confirm the change.

References

• ZoomEye query app="Drupal", checked 25 September 2026, exact count 436263

• ZoomEye query vul.cve="CVE-2026-96357", checked 25 September 2026, no result

• CERT-BUND advisory WID-SEC-2026-3554, high risk, CVSS v3.1 9.8

• Drupal advisories sa-contrib-2026-154 through sa-contrib-2026-191