What CERT-BUND Published About CVE-2026-96361 and What the Record Leaves Open
What CERT-BUND Published About CVE-2026-96361 and What the Record Leaves Open Vulnerability overview CVE-2026-96361 appears in WID-SEC-2026-3554, a CERT-BUND advisory published on 23 September 2026 and rated high risk. The record lists 36 identifiers from CVE-2026-96355 to CVE-2026-96398 and names 16 contributed Drupal projects. Reading an advisory well means separating the published facts from…
CERT-BUND published a high-risk advisory, WID-SEC-2026-3554, on September 23, 2026, concerning CVE-2026-96361. The vulnerability allows remote code execution, privilege escalation, and other malicious activities due to remote exploitation. The affected projects include Webform, Webform REST, Cloud, Project Browser, Commerce Decoupled Checkout, Mermaid Diagram Field, CookieCuttr, REST & JSON API Authentication, Stop administrator login, Tawk.to Live chat application, Editoria11y Accessibility Checker, AI CKEditor, Combined image style, CSS Usage Analyzer, Smart Content, and Diba carousel slider.
The advisory does not specify the underlying defect or assign a separate CVSS vector for each project. The risk is rated as high, with a base score of 9.8 and a temporal score of 8.5. The affected products are not limited to the core Drupal system. There are 436,344 indexed Drupal assets, but the advisory does not connect these assets to the specific modules.
To remediate, identify the affected projects, update to the appropriate fixed release, and monitor the revision number for updates.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
