Verifying That CVE-2026-96369 Is Actually Fixed on Each Drupal Instance

Vulnerability overview

CVE-2026-96369 belongs to CERT-BUND advisory WID-SEC-2026-3554, published 23 September 2026 and rated high risk. The advisory carries 36 identifiers, CVE-2026-96355 through CVE-2026-96398, all concerning contributed Drupal projects. The structured record applies a CVSS v3.1 base score of 98 and a temporal score of 85 to the batch.
The advisory names fixed releases for sixteen projects. Declaring the work done on the basis of an update command's exit code is where verification usually fails.

Mechanism and exploitation conditions

CERT-BUND describes outcomes rather than mechanisms: arbitrary code execution, privilege escalation, security bypass, data manipulation and disclosure, cross-site scripting. It publishes no vulnerable function, no parameter, and no per-identifier project mapping.
Contributed modules execute as PHP in the Drupal request cycle under the web server account. A flaw is reachable when the module's route is exposed and accepts attacker-controlled input. The advisory does not specify which routes those are for CVE-2026-96369.

Impact

Assume the effects span the batch. Code execution against a module reaches the hosting account. Privilege escalation widens a limited account. Data outcomes affect integrity and confidentiality. Cross-site scripting reaches authenticated sessions, administrative ones included.

Affected products and scope

Webform 6.2.12 and 6.3.1. Project Browser 2.0.3 and 2.1.5. Editoria11y Accessibility Checker 2.2.23 and 3.0.9. Webform REST 4.2.1. Cloud 7.0.1. Commerce Decoupled Checkout 1.8.0. Mermaid Diagram Field 1.0.9. CookieCuttr 2.0.3. REST & JSON API Authentication 3.2.0. Stop administrator login 1.6. Tawk.to Live chat application 3.0.4. AI CKEditor 1.4.3. Combined image style in 1.0.7. CSS Usage Analyzer 1.0.2. Smart Content 3.2.1. Diba carousel slider 3.0.2.
Builds below the fixed release on the branch in use are affected. Drupal core is outside the advisory.

Exposure context

On 28 September 2026 ZoomEye returned 436,345 assets for app="Drupal" and zero for vul.cve="CVE-2026-96369". The first is a population figure for the indexed Drupal fleet, the second an index coverage fact. Neither substitutes for checking your own instances.

Remediation and mitigations

Verify from four independent sources and reconcile them. The site's status report shows what the application believes is installed. The module's .info.yml inside the running deployment shows the actual code version. The Composer lock file shows what the dependency manager recorded. The filesystem under modules/contrib shows what is really on disk.
When those four disagree, the disagreement is the finding. A lock file ahead of the filesystem means the deploy did not complete. A filesystem ahead of the lock file means a manual change that the next composer install will overwrite. A status report ahead of both means a caching layer is serving stale metadata.
Repeat the check after any subsequent deployment touching the same instance, because a later release can reintroduce an old module if constraints shift. Record the verification result per instance with a timestamp, so that the next audit starts from evidence rather than memory.

References

• CERT-BUND advisory WID-SEC-2026-3554, published 23 September 2026, high risk
• CERT-BUND structured advisory record, affected and fixed versions, CVSS v3.1 base 98, temporal 85
• ZoomEye search app="Drupal", executed 28 September 2026, exact count 436345