Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
CVE-2026-96359 is a cross-site scripting (XSS) flaw in the contributed Webform module for Drupal, not in Drupal core. Drupal’s official advisory, SA-CONTRIB-2026-159, fixes it in Webform 6.2.12 for the 6.2.x branch and Webform 6.3.1 for the 6.3.x branch. The CERT-Bund reference WID-SEC-2026-3554 could not be confirmed from its own record, so it cannot be used to establish what this CVE affects beyond the Drupal advisory.
What the vulnerability is
Webform’s color element did not sufficiently sanitize the attributes it uses. Under certain conditions, specially crafted attributes can result in XSS when that element is rendered. Drupal’s Security Team published the individual Webform advisory, SA-CONTRIB-2026-159, on 23 September 2026.
Which sites are affected
Compare the installed Webform version with the affected ranges that the advisory lists:
| Webform branch | Affected range per advisory | Fixed release to install |
|---|---|---|
| 6.2.x | Below 6.2.12 (written in the advisory as <6.2.12) |
6.2.12 |
| 6.3.x | 6.3.0 up to, but not including, 6.3.1 (written as >=6.3.0 <6.3.1) |
6.3.1 |
Read literally, the first range covers every release below 6.2.12, including older branches. Treat any site on an earlier Webform release as affected until it is moved to the fixed release for its branch. The advisory does not list Drupal core.
#1 Best Overall
The trigger condition in plain terms
The advisory states that an attacker must be able to add a specially crafted link with a specific class to the same page as the affected Webform. The advisory presents this as a mitigating factor:
“This vulnerability is mitigated by the fact that an attacker must be able to add a specially crafted link with a specific class to the same page as the affected webform.”
The condition is about placement. A Webform on a page where only trusted administrators can insert markup presents a different exposure than one on a page where other users can add content. The advisory does not say which roles or content types create that path, so the review has to be done against your own site. This reading is an inference from the stated condition.
Severity
Drupal rates CVE-2026-96359 as Moderately critical, 12/25, in the individual Webform advisory. That rating applies to this CVE as described in SA-CONTRIB-2026-159. No separate severity score for WID-SEC-2026-3554 has been verified.
Rank #3
What WID-SEC-2026-3554 does and does not establish
The CERT-Bund WID service publishes vulnerability, patch, and workaround information for German government and other subscribers. Its service description confirms that purpose. It does not establish what the individual advisory WID-SEC-2026-3554 contains, and this article could not retrieve that record.
Some secondary search results describe WID-SEC-2026-3554 as covering 36 CVEs across 16 projects, with batch scores and fixed versions. Those figures could not be checked against the CERT-Bund record, so this article does not rely on them. Treat them as unconfirmed.
To settle the question for your own site:
- Open WID-SEC-2026-3554 in the CERT-Bund WID service and read which CVEs and products it lists.
- Check whether CVE-2026-96359 appears in that entry. If it does, compare the Webform version range it gives with the Drupal ranges in the table above.
- If the CERT-Bund entry gives a different fixed version or score for Webform, do not mix the two sources. Use the Drupal advisory for the figures quoted here, and raise the discrepancy with your security contact before choosing which release to deploy.
Timeline and scope of the release
Drupal’s public service announcement of 21 September 2026 said a contributed-project security release would take place on 23 September 2026, and that Drupal core was not affected by that release. The Webform advisory carries the 23 September publication date. Sharing a release date does not mean that every contributed project in it has the same flaw or severity, so check each project your site runs.
Free tools Windows power users keep installed
One-click scans. No signup required.
How to patch Webform
- Confirm the installed version. In the Drupal admin interface, open Extend at
/admin/modulesand find Webform, or runcomposer show drupal/webformfrom the site root. - Choose the fixed release for your branch: 6.2.12 for 6.2.x, or 6.3.1 for 6.3.x.
- Back up the database and the codebase before changing anything.
- Update the module. On a Composer-managed site, run
composer require drupal/webform:6.3.1(orcomposer require drupal/webform:6.2.12for the 6.2.x branch), then confirm that composer.json and composer.lock changed as expected. - Apply database updates and clear caches:
vendor/bin/drush updatedb -y, thenvendor/bin/drush cache:rebuild. - Run
composer show drupal/webformagain and confirm the version matches the fixed release. Then reload the Extend page to check the status.
Interim measures before patching
Patching is the fix. If you cannot deploy right away, the advisory’s stated condition suggests a short review: list the pages where a Webform renders, identify the users who can add links or markup to those pages, and remove that permission where it is not needed. This is an inference from the advisory’s condition, not a workaround published by Drupal or CERT-Bund.
Quick Recap
Best Value
What is not established
- Whether the flaw has been exploited in the wild. The sources reviewed do not report exploitation, which is not the same as confirming that it has not occurred.
- Whether anyone has tested or demonstrated an exploit. This article did not test the vulnerability.
- How many sites are affected. The sources do not provide a prevalence or impact figure.
- What WID-SEC-2026-3554 contains beyond the description of the CERT-Bund service.
Sources used
- Drupal Security Team, SA-CONTRIB-2026-159, Webform cross-site scripting advisory, published 23 September 2026.
- Drupal public service announcement on the contributed-project security release, published 21 September 2026.
- CERT-Bund WID service description, which confirms the service’s purpose only.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
