PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-96363 Drupal CVE debrief

The Drupal Webform module is vulnerable to Stored Cross-Site Scripting (XSS) due to a Privilege Defined With Unsafe Actions issue, affecting versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1. This vulnerability allows attackers to inject malicious scripts into Webform, potentially leading to unauthorized actions or data exposure. Defenders should assess and remediate affected installations, prioritizing patching and monitoring for suspicious activity. The vulnerability's impact on data integrity and confidentiality necessitates immediate attention, and defenders should review user privileges to prevent exploitation.

Vendor
Drupal
Product
Webform
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-22
Original CVE updated
2026-10-30
Advisory published
2026-10-22
Advisory updated
2026-10-30

Who should care

Drupal administrators, Webform module users, and security teams responsible for assessing and mitigating vulnerabilities in content management systems should be aware of this vulnerability and take necessary actions to protect their installations.

Why it matters

CVE-2026-96363 is a Stored XSS vulnerability in Drupal Webform that requires assessment and remediation. Defenders should prioritize patching affected versions and monitoring for suspicious activity.

  • Potential for unauthorized script injection and execution.
  • Possible impact on data integrity and confidentiality.
  • Required assessment and remediation of affected Webform installations.
  • Need for monitoring and incident response planning.

Technical summary

The Drupal Webform module is vulnerable to Stored Cross-Site Scripting (XSS) due to a Privilege Defined With Unsafe Actions issue. This affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1. An attacker could exploit this vulnerability to inject malicious scripts into the Webform, potentially leading to unauthorized actions or data exposure.

Defensive priority

Defenders should prioritize assessment and remediation of this vulnerability in Drupal Webform installations, particularly for versions within the affected ranges.

Recommended defensive actions

  • Assess Drupal Webform installations for affected versions (0.0.0 to 6.2.12, 6.3.0 to 6.3.1).
  • Verify and apply available patches or updates for Drupal Webform.
  • Monitor Webform usage for suspicious activity.
  • Review and adjust user privileges to prevent exploitation.

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and references to official advisories. The vulnerability exists in Drupal Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1. Official advisories and CVE metadata confirm the Privilege Defined With Unsafe Actions issue leading to Stored XSS. Defenders should verify and apply patches or updates for Drupal Webform, monitor usage for suspicious activity, and review user privileges to prevent

Sources and references

Verified primary and authoritative sources

  • CVE-2026-96363 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-96363

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-96363 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-96363

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.