CERT-BUND flags 36 Drupal module vulnerabilities at high risk with CVSS 9.8 batch score

CERT-BUND, Germany's national computer emergency response team, published advisory WID-SEC-2026-3554 on 23 September 2026 and rated it high risk. According to a dev.to analysis of the record, the advisory covers 36 CVE identifiers — CVE-2026-96361 among them — spanning CVE-2026-96355 through CVE-2026-96398, and names 16 contributed Drupal projects, each with a fixed release already available. Drupal core is explicitly excluded from the scope.

What the advisory covers

The dev.to write-up lists the affected projects together with their patched versions: Webform 6.2.12 and 6.3.1, Webform REST 4.2.1, Cloud 7.0.1, Project Browser 2.0.3 and 2.1.5, Commerce Decoupled Checkout 1.8.0, Mermaid Diagram Field 1.0.9, CookieCuttr 2.0.3, REST & JSON API Authentication 3.2.0, Stop administrator login 1.6, Tawk.to Live chat application 3.0.4, Editoria11y Accessibility Checker 2.2.23 and 3.0.9, AI CKEditor 1.4.3, Combined image style 1.0.7, CSS Usage Analyzer 1.0.2, Smart Content 3.2.1, and Diba carousel slider 3.0.2.

How the risk is described

The published mechanism details are general on causes but specific on the essentials: the issues are reachable over HTTP, they are remotely exploitable, and fixes exist. The recorded outcome classes include arbitrary code execution, extended privileges, bypass of security measures, data manipulation or disclosure, and cross-site scripting.

Scoring is recorded at batch level rather than per identifier. The advisory assigns damage and probability both 4 out of 4, a high overall risk rating, and CVSS v3.1 scores of 9.8 base and 8.5 temporal.

What the record leaves open

As the dev.to analysis points out, three gaps matter for anyone triaging this. The advisory does not map individual CVEs to individual projects, it does not describe the technical defect behind CVE-2026-96361, and it does not publish separate CVSS vectors per identifier.

That sets a hard limit on detection logic. The record supports a check along the lines of whether a site runs an affected module below its fixed version, but it cannot support a fingerprint for any specific flaw. Rules that depend on a defect description the advisory does not provide would be guessing.

Measured exposure

The dev.to write-up reports a ZoomEye query for app="Drupal" executed on 26 September 2026 that returned 436,344 indexed assets. A companion query for vul.cve="CVE-2026-96361" returned zero results. Two caveats apply: the asset count describes only the indexed Drupal population, and nothing in the advisory connects those assets to the listed modules.

What operators should do

The recommended path follows directly from what the advisory does publish:

• Inventory the site against the 16 named projects.
• Apply the matching fixed release and verify the running version afterwards.
• Avoid building detection logic that assumes defect details the record does not contain.
• Track the advisory revision. CERT-BUND collected this as revision 1, its initial version, and updates land in the same record rather than a new one, so rechecking the revision number is the cheapest way to learn whether the gaps have been filled.

Why it matters

A batch advisory that scores maximum damage and probability but publishes no per-flaw detail inverts the usual triage workflow. Operators cannot wait for exploit specifics or a per-CVE risk ranking before acting; the actionable signal is the module and version list itself. For teams running contributed Drupal modules, the exposure question is inventory-based — which of these 16 are installed — rather than vulnerability-based. The advisory's structure also sets expectations for scanning and exposure-management vendors, whose coverage claims for these CVEs should rest on version checks rather than behavioral fingerprints until CERT-BUND or the module maintainers publish more granular detail.