PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-96367 Drupal CVE debrief

The Drupal Webform module has a Privilege Defined With Unsafe Actions vulnerability, allowing Stored Cross-Site Scripting (XSS). This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1. Defenders should assess exposure, prioritize remediation, and monitor for suspicious activity related to Webform usage. Verification of Webform version exposure is required to determine potential vulnerability. Remediation priority is high for environments using affected Webform versions.

Vendor
Drupal
Product
Webform
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-22
Original CVE updated
2026-10-22
Advisory published
2026-10-22
Advisory updated
2026-10-22

Who should care

Defenders responsible for Drupal installations, particularly those using the Webform module, should assess exposure and prioritize remediation.

Why it matters

CVE-2026-96367 is a Stored Cross-Site Scripting (XSS) vulnerability in the Drupal Webform module, affecting multiple versions. Defenders should assess exposure, prioritize remediation, and monitor for suspicious activity.

  • Verification of Webform version exposure is required to determine potential vulnerability.
  • Remediation priority is high for environments using affected Webform versions.
  • Monitoring for suspicious activity related to Webform usage is recommended.

Technical summary

The Drupal Webform module has a Privilege Defined With Unsafe Actions vulnerability, allowing Stored Cross-Site Scripting (XSS). This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1. The vulnerability allows attackers to inject malicious scripts, potentially leading to unauthorized actions. Defenders should assess exposure and prioritize remediation.

Defensive priority

Defenders should prioritize assessment and remediation of this vulnerability in Webform versions 0.0.0 to 6.2.12 and 6.3.0 to 6.3.1.

Recommended defensive actions

  • Assess exposure of Webform versions 0.0.0 to 6.2.12 and 6.3.0 to 6.3.1 in your environment.
  • Verify if your Webform version is affected and update to a secure version if necessary.
  • Monitor Webform usage for suspicious activity.

Evidence notes

The CVE record and source item provide details on the vulnerability in Drupal Webform module, affecting versions 0.0.0 to 6.2.12 and 6.3.0 to 6.3.1. The vulnerability allows Stored Cross-Site Scripting (XSS) due to a Privilege Defined With Unsafe Actions issue. Defenders should verify Webform versions, assess exposure, and prioritize remediation. Evidence is limited to CVE and source item details, with verification tasks recommended for defenders.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-96367 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-96367

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-96367 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-96367

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.