Reading the Drupal sa-contrib-2026-154 to 191 Cluster: What CVE-2026-96361's Advisory Batch Discloses

Vulnerability overview

CVE-2026-96361 sits inside a 36-identifier cluster published by CERT-BUND on 23 September 2026 as WID-SEC-2026-3554. The German federal warning service rated the batch high risk and recorded it as revision 1, described as the initial version of the record.
The cluster covers contributed Drupal projects. Its identifiers run from CVE-2026-96355 to CVE-2026-96398, and it references 36 Drupal security advisories, sa-contrib-2026-154 through sa-contrib-2026-191.

Mechanism and exploitation conditions

The public record does not tie each identifier to an individual defect. It states the outcome classes instead: an attacker can exploit multiple vulnerabilities to execute arbitrary code, gain extended privileges, bypass security measures, manipulate and disclose data, or carry out cross-site scripting attacks.
That phrasing sets the exploitation conditions at batch level. The affected component is a module installed on a Drupal site, access is remote, and the entry point is the HTTP interface the site already publishes. The record marks remote exploitability as true and notes that a patch exists.

Impact

The five outcome classes map to server compromise, privilege gain, control bypass, data exposure or alteration, and script injection against site visitors. CERT-BUND scores probability and damage at 4 out of 4, and the batch carries a CVSS v3.1 base score of 9.8 with a temporal score of 8.5.
The record lists Linux, UNIX, Windows and other operating systems, which shows the risk follows the module code rather than the host platform.

Affected products and scope

The audit trail names 16 contributed projects and 19 affected-to-fixed version pairs. Webform, Project Browser and Editoria11y Accessibility Checker each shipped two fixed releases, and the other 13 projects shipped one. Drupal core is not in the list.
The gaps between CVE-2026-96380 and CVE-2026-96398 are a normal artifact of batch CVE assignment rather than withdrawn items.

Exposure context

A ZoomEye query for app="Drupal" returned 436,344 assets on 26 September 2026, which describes the indexed Drupal population rather than confirmed vulnerable hosts. The companion query vul.cve="CVE-2026-96361" returned 0, so the identifier is not indexed as an exposed service.

Remediation and mitigations

Read the cluster at project granularity. Match each of the 16 projects against your installed modules, then apply the fixed release that matches your branch. The advisory references sa-contrib-2026-154 through sa-contrib-2026-191, so each project's own fix note can be checked directly.
Treat revision 1 as a snapshot and recheck the advisory before closing the task, because CERT-BUND updates records in place. That is the real win.

References

• CERT-BUND advisory WID-SEC-2026-3554, revision 1, published 23 September 2026
• CERT-BUND structured record for WID-SEC-2026-3554, 36 identifiers and 19 fixed releases
• ZoomEye search app="Drupal", executed 26 September 2026, exact count 436344