Nineteen Fixed Releases, Sixteen Projects: Changelog Forensics for CVE-2026-96365

Vulnerability overview

CVE-2026-96365 is carried by CERT-BUND advisory WID-SEC-2026-3554, published on 23 September 2026 and rated high risk. The advisory lists 36 identifiers, CVE-2026-96355 through CVE-2026-96398, against 16 contributed Drupal projects. The structured record is unusual for its release detail: it pairs those 16 projects with 19 fixed releases.

Mechanism and exploitation conditions

No per-identifier flaw description is published. The record states outcome classes instead, covering arbitrary code execution, extended privileges, bypass of security measures, data manipulation or disclosure, and cross-site scripting, and marks the issues remotely exploitable with patches available. What the release list adds is confirmation that fixes exist for each named project, including branch-specific ones.

Impact

Where a project shipped two fixed releases, the impact question splits by branch: a site on the older supported line needs a different artifact from a site on the newest line. CERT-BUND scores probability and damage at 4 out of 4 for the batch, with a CVSS v3.1 base score of 9.8 and a temporal score of 8.5.

Affected products and scope

The 19 fixed releases map to 16 projects as follows: Webform 6.2.12 and 6.3.1, Webform REST 4.2.1, Cloud 7.0.1, Project Browser 2.0.3 and 2.1.5, Commerce Decoupled Checkout 1.8.0, Mermaid Diagram Field 1.0.9, CookieCuttr 2.0.3, REST & JSON API Authentication 3.2.0, Stop administrator login 1.6, Tawk.to Live chat application 3.0.4, Editoria11y Accessibility Checker 2.2.23 and 3.0.9, AI CKEditor 1.4.3, Combined image style 1.0.7, CSS Usage Analyzer 1.0.2, Smart Content 3.2.1, and Diba carousel slider 3.0.2.

Exposure context

ZoomEye indexed 436403 assets matching app="Drupal" on 27 September 2026. That figure counts Drupal deployments rather than sites running one of these 16 modules. The companion query vul.cve="CVE-2026-96365" returned 0.

Remediation and mitigations

Work from the release list rather than from the CVE list. For each project in use, read its own fix note, identify the correct branch, and apply the corresponding release. Where two releases exist, verify the branch before downloading rather than after, because installing the wrong branch is a common source of failed remediation. Record the version you moved to so the next audit has a baseline.

References

• CERT-BUND advisory WID-SEC-2026-3554, published 23 September 2026: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3554
• CERT-BUND structured record for WID-SEC-2026-3554, 16 projects and 19 fixed releases: https://wid.cert-bund.de/content/public/content/3f0df5d6-5291-41b3-92f2-0c016281c91f
• ZoomEye search app="Drupal", executed 27 September 2026, exact count 436403: https://www.zoomeye.ai/searchResult?q=YXBwPSJEcnVwYWwi