CVE-2026-96361 Risk Ranking: Applying the CERT-BUND Damage and Probability Scores

Vulnerability overview

CVE-2026-96361 is one of 36 identifiers in WID-SEC-2026-3554, published by CERT-BUND on 23 September 2026 as a high risk advisory covering 16 contributed Drupal projects.
Risk ranking needs more than a headline rating, and this record supplies two numbers that help.

Mechanism and exploitation conditions

CERT-BUND scores the batch as remotely exploitable and patched. The published outcome classes are arbitrary code execution, extended privileges, bypass of security measures, data manipulation or disclosure, and cross-site scripting. No per-identifier mechanism statement is included in the record used here.
What the ranking depends on is which module a site runs and whether a visitor can reach it. A module that serves anonymous traffic is a different case from one restricted to authenticated staff.

Impact

The record sets damage and probability at 4 out of 4 each, labels the batch high risk, and records a CVSS v3.1 base score of 9.8 with a temporal score of 8.5. The combination of maximum probability and maximum damage is what puts this batch at the top of a remediation queue.
Ranking multiple advisories with the same high rating needs a tiebreaker. Reachability is the practical one here: count the affected modules you expose to unauthenticated traffic, then order those sites first.

Affected products and scope

The 16 projects are Webform, Webform REST, Cloud, Project Browser, Commerce Decoupled Checkout, Mermaid Diagram Field, CookieCuttr, REST & JSON API Authentication, Stop administrator login, Tawk.to Live chat application, Editoria11y Accessibility Checker, AI CKEditor, Combined image style, CSS Usage Analyzer, Smart Content, and Diba carousel slider. Drupal core is not included. Nineteen fixed releases cover them, and three projects shipped two each.

Exposure context

ZoomEye returned 436,344 assets for app="Drupal" on 26 September 2026, which counts indexed Drupal deployments rather than confirmed vulnerable hosts. A companion query for vul.cve="CVE-2026-96361" returned 0.

Remediation and mitigations

Use the scoring data to decide order, not to decide whether to act. Apply the fixed release for each affected module, and start with the ones reachable from the public internet. Then revisit the ranking against your own exposure figures rather than the global index.
Keep the record current. CERT-BUND updates advisories in place, so a revision can change the scoring after a site has already triaged the first version.

References

• CERT-BUND advisory WID-SEC-2026-3554, published 23 September 2026
• CERT-BUND structured record for WID-SEC-2026-3554, damage and probability 4 of 4, CVSS v3.1 base 9.8 and temporal 8.5
• ZoomEye search app="Drupal", executed 26 September 2026, exact count 436344