CVE-2026-96358: What Remote Exploitability Means for a Drupal Extension Flaw

Vulnerability overview

CVE-2026-96358 appears in CERT-BUND advisory WID-SEC-2026-3554, released on 23 September 2026 and rated high risk. The record covers multiple vulnerabilities in Drupal contributed modules, states that fixes exist, and marks the issues as remotely exploitable.

Mechanism and exploitation conditions

The advisory describes the batch with one sentence. An attacker can use the vulnerabilities to execute arbitrary code, gain elevated privileges, bypass security measures, tamper with and disclose data, or conduct cross-site scripting attacks.
Remote exploitability is the load-bearing detail. It means the attacker does not need local access or an authenticated session on the host to reach the vulnerable code path. For a Drupal contributed module, that usually points at a request-handling entry point such as a route, a form handler or an API endpoint the module exposes.
The record does not identify which of those entry points applies to CVE-2026-96358, and it does not assign a single flaw class to it.

Impact

Remote reachability changes prioritisation. A flaw that needs an authenticated administrator is a lower immediate risk than one reachable by an unauthenticated request, because the attacker population and the exploitation effort differ sharply.

Affected products and scope

The record lists 19 affected version ranges across 16 contributed projects, including Webform, Project Browser, Editoria11y Accessibility Checker, Commerce Decoupled Checkout, Webform REST, Stop administrator login, Cloud, Mermaid Diagram Field, CookieCuttr, Tawk.to-Live chat application, AI CKEditor, Combined image style, CSS Usage Analyzer, Smart Content and Diba carousel slider. It records cpe:/a:drupal:drupal with Linux, UNIX, Windows and other platforms.

Exposure context

A ZoomEye query for app="Drupal" returned 436276 matching instances on 25 September 2026, and vul.cve="CVE-2026-96358" returned zero. The product count shows how much Drupal is exposed to internet scanning; it does not show which contributed modules those hosts run.

Remediation and mitigations

Where a listed module is installed at an in-range version, treat the update as the priority action rather than a scheduled chore. Until the update lands, reduce how far the module is reachable from untrusted networks and check whether it exposes functionality to anonymous users.

References

• CERT-BUND advisory WID-SEC-2026-3554, released 23 September 2026, high risk, remotely exploitable
• CERT-BUND structured advisory record for WID-SEC-2026-3554
• ZoomEye query app="Drupal", checked 25 September 2026