PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-96368 Drupal CVE debrief

A Cross-site Scripting (XSS) vulnerability exists in Drupal Webform, affecting versions from 0.0.0 to 6.2.12 and 6.3.0 to 6.3.1. This issue allows for Stored XSS. The CVE record was published on 2026-10-22T01:21:43.032Z and has not been modified since then. The NVD entry is currently unclassified. Defenders should assess exposure, prioritize remediation, and verify versions to mitigate potential risks. This vulnerability allows for Stored XSS attacks through user-generated content, risk of unauthorized script execution within the Webform context, and need for verification of Webform versions and exposure.

Vendor
Drupal
Product
Webform
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-22
Original CVE updated
2026-10-22
Advisory published
2026-10-22
Advisory updated
2026-10-22

Who should care

Defenders responsible for Drupal installations, particularly those using the Webform module, should assess exposure and prioritize remediation. Roles include system administrators, security teams, and developers working with Drupal Webform.

Why it matters

This CVE highlights a Stored XSS vulnerability in Drupal Webform, affecting multiple versions. Defenders should assess exposure, prioritize remediation, and verify versions to mitigate potential risks.

  • Potential for Stored XSS attacks through user-generated content
  • Risk of unauthorized script execution within the Webform context
  • Need for verification of Webform versions and exposure
  • Priority for applying patches or updates to vulnerable versions

Technical summary

The Drupal Webform module is vulnerable to a Stored Cross-site Scripting (XSS) attack. This occurs due to improper neutralization of input during web page generation. The vulnerability affects Webform versions from 0.0.0 to 6.2.12 and 6.3.0 to 6.3.1.

Defensive priority

Defenders should prioritize assessment and remediation of this vulnerability in Webform installations, particularly those with user-generated content or public access.

Recommended defensive actions

  • Assess exposure of Webform installations to this vulnerability
  • Verify versions and apply patches or updates as available
  • Monitor for potential exploitation attempts
  • Implement additional security measures for user-generated content

Evidence notes

The CVE record and source item provide details on the vulnerability, but additional information on exploitation or affected systems is limited. There is no evidence of exploitation or specific affected systems. Defenders should verify Webform versions, assess exposure, and prioritize remediation. The vulnerability affects Webform versions from 0.0.0 to 6.2.12 and 6.3.0 to 6.3.1. Limited information is available on potential impacts or mitigation strategies beyond applying patches or

Sources and references

Verified primary and authoritative sources

  • CVE-2026-96368 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-96368

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-96368 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-96368

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.