What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
No. A zero result for vul.cve="CVE-2026-96365" means the reported ZoomEye query found no matching indexed assets; it does not prove that no vulnerable Drupal sites exist or that a particular site is safe. Exposure depends on the Webform version and configuration actually running on the site.
What CVE-2026-96365 affects
Drupal’s security advisory identifies CVE-2026-96365 as a denial-of-service vulnerability in the Webform module. Webform does not sufficiently validate an optional token query value before using it. In specific configurations where a Webform is rendered for anonymous visitors, a malicious request can consume significant resources and cause denial of service. This is a conditional risk, not a claim that every site using Webform is automatically vulnerable. Drupal Security Advisory SA-CONTRIB-2026-170 was published September 23, 2026.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Drupal 7 Webform Cookbook | $152.29 | Buy on Amazon |
The advisory rates the issue “Less critical 8 ∕ 25” and lists the rating factors as AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:Uncommon. This is Drupal’s own advisory rating; it should not be treated as a score from a different system.
Affected Webform versions and fixes
| Webform branch | Affected versions | Fixed version |
|---|---|---|
| 6.2.x | Below 6.2.12 | 6.2.12 |
| 6.3.x | 6.3.0 through versions below 6.3.1 | 6.3.1 |
These ranges and fixes are from the Drupal advisory. Check the version of Webform, rather than inferring exposure from the Drupal application name alone.
#1 Best Overall
What the reported zero does—and does not—show
A secondary article reports that on September 27, 2026, a ZoomEye query for app="Drupal" returned 436403 assets, while vul.cve="CVE-2026-96365" returned zero. Those are query results reported for that date, not verified current counts. The report is available in the DEV Community article.
- The Drupal query count does not identify which assets use Webform or which versions they run.
- The CVE query count says only that the reported query returned no matching indexed assets. It is not a count of affected or unaffected deployments.
- Neither result inventories private systems or verifies the software and configuration on a specific host.
NIST describes the National Vulnerability Database as a repository of vulnerability information that can include affected-software configuration data. Such records help identify products and versions; they are not an inventory of your own systems or proof that an external scanner recognizes every vulnerable installation. See NIST’s NVD overview.
Quick Recap
How to assess your own Drupal sites
- Inventory deployments. Identify the Drupal sites and environments you operate, including staging and deployments that receive less frequent maintenance.
- Check Webform versions. On each relevant site, compare the installed module version with the affected ranges in the Drupal advisory.
- Review the condition. Determine whether a Webform is rendered for anonymous visitors and assess the site configuration against the advisory’s stated condition.
- Apply the branch fix. Upgrade affected 6.2.x installations to 6.2.12 and affected 6.3.x installations to 6.3.1, following the advisory and your normal release process.
- Record the outcome. Note each installed version and update result. Do not use an external query’s zero as a substitute for this site-by-site check.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
