CVE-2026-96358: Sixteen Projects, Nineteen Ranges, One Advisory Batch

Vulnerability overview

CVE-2026-96358 is one of 36 CVE identifiers listed in CERT-BUND advisory WID-SEC-2026-3554, released on 23 September 2026 and rated high risk. The advisory covers multiple vulnerabilities in Drupal contributed modules, is marked remotely exploitable and records that fixes exist.

Mechanism and exploitation conditions

The record keeps one impact sentence for all 36 identifiers: an attacker can use the vulnerabilities to execute arbitrary code, gain elevated privileges, bypass security measures, tamper with and disclose data, or conduct cross-site scripting attacks.
That structure makes the version list the operative part of the advisory. Sixteen projects and 19 ranges are what an operator can actually act on.

The affected ranges in one view

Webform, Project Browser and Editoria11y Accessibility Checker each appear on two branches. Webform is affected below 6.2.12 and below 6.3.1, fixed in 6.2.12 and 6.3.1. Project Browser is affected below 2.0.3 and below 2.1.5, fixed in 2.0.3 and 2.1.5. Editoria11y Accessibility Checker is affected below 2.2.23 and below 3.0.9, fixed in 2.2.23 and 3.0.9.
The single-branch projects are Cloud below 7.0.1, Commerce Decoupled Checkout below 1.8.0, Mermaid Diagram Field below 1.0.9, CookieCuttr below 2.0.3, Stop administrator login below 1.6, Tawk.to-Live chat application below 3.0.4, Webform REST below 4.2.1, AI CKEditor below 1.4.3, Combined image style below 1.0.7, CSS Usage Analyzer below 1.0.2, Smart Content below 3.2.1 and Diba carousel slider below 3.0.2, each fixed in the same release number with the "below" bound removed.

Affected products and scope

The CPE entry is cpe:/a:drupal:drupal and the record lists Linux, UNIX, Windows and other platforms, which describes where Drupal runs rather than a platform-specific defect.

Impact

Two-branch projects deserve care: reading only the newer branch can leave an older site apparently unaffected when it is not, and applying the wrong fixed version can leave the flaw in place.

Exposure context

ZoomEye returned 436276 instances for app="Drupal" on 25 September 2026 and zero for vul.cve="CVE-2026-96358". The product figure describes Drupal deployments rather than affected contributed modules.

Remediation and mitigations

Match each installed project to its correct branch, update to that branch's fixed release, and record the version afterwards. The per-project Drupal advisory remains the authority for a specific fix.