Internet-Exposed Drupal Sites and the September 2026 Extension Advisory

Exposure first

A ZoomEye query for the Drupal fingerprint returned 436,286 matching assets when the query ran on 24 September 2026. That number describes Drupal deployments visible in the index. It does not describe how many of them run a vulnerable contributed module, and the distinction matters for planning.
The published count still frames the problem. Advisory WID-SEC-2026-3554 covers flaws in contributed Drupal projects, and a deployment has to be reachable before a remote attacker can attempt exploitation. Sites behind an internal reverse proxy or a VPN have a smaller practical window than a site answering directly on port 443.

What the exposure figure does not tell you

The query matches the Drupal fingerprint, which appears in headers, titles, and response bodies of many Drupal sites. It cannot see which contributed modules are installed, because module code and configuration sit behind authentication.
An operator reading the figure should draw one conclusion: the population of potential targets is large, and identification of vulnerable instances does not depend on any published list. Attackers scan for Drupal, then probe for known module routes.

The affected surface

Advisory WID-SEC-2026-3554 covers 36 CVE identifiers in contributed projects including Webform, Webform REST, Cloud, Project Browser, Commerce Decoupled Checkout, Mermaid Diagram Field, CookieCuttr, REST & JSON API Authentication, Stop administrator login, Tawk.to Live chat application, Editoria11y Accessibility Checker, AI CKEditor, Combined image style, CSS Usage Analyzer, Smart Content and Diba carousel slider. Fixed releases exist for each, listed as Webform 6.2.12 and 6.3.1, Webform REST 4.2.1, Cloud 7.0.1, Project Browser 2.0.3 and 2.1.5, Commerce Decoupled Checkout 1.8.0, Mermaid Diagram Field 1.0.9, CookieCuttr 2.0.3, REST & JSON API Authentication 3.2.0, Stop administrator login 1.6, Tawk.to Live chat application 3.0.4, Editoria11y Accessibility Checker 2.2.23 and 3.0.9, AI CKEditor 1.4.3, Combined image style 1.0.7, CSS Usage Analyzer 1.0.2, Smart Content 3.2.1 and Diba carousel slider 3.0.2.
Authentication-related projects in that list are the ones to prioritize on an internet-facing site. REST & JSON API Authentication and Stop administrator login protect the outer layer of the application, and flaws there are reachable without any prior foothold.

Practical prioritization

Start with the sites that answer requests from the public internet and accept unauthenticated traffic. For each of those, list installed contributed projects, then compare versions with the advisory. A site that runs five of the affected projects is a different priority from one that runs none.
Rank by reachability rather than by CVE count. A single authenticated-only module matters less than an API module exposed without rate limiting.

Response guidance

Patch the identified projects to the fixed releases and confirm the files on disk changed. Then restrict unauthenticated access to administrative and API routes at the reverse proxy while the update campaign completes.
Re-run the exposure query after patching to track how quickly the population of unpatched hosts changes.

References

• CERT-BUND advisory WID-SEC-2026-3554, published 23 September 2026, high risk
• CERT-BUND structured advisory record, product references and referenced Drupal advisories
• ZoomEye exposure query app="Drupal", executed 24 September 2026, exact count 436286