iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
CVE-2026-96360 affects Drupal’s Webform module, but Drupal.org has not published a CVE-specific detection rule, log signature, or monitoring procedure. The practical first check is your installed Webform version: versions below 6.2.12 and versions from 6.3.0 to below 6.3.1 are affected. Upgrade the 6.2.x branch to 6.2.12 or the 6.3.x branch to 6.3.1, as applicable.
What CVE-2026-96360 affects
Drupal.org describes CVE-2026-96360 as a cross-site scripting (XSS) risk in the Webform module, which site builders use to create forms and manage submissions. In some configurations, specially crafted announcement text may not be properly sanitized. Webform uses JavaScript behaviours to announce dynamic form updates to assistive technologies; the advisory links the issue to that announcement text and users interacting with an affected Webform.
The advisory classifies the issue as “Moderately critical 11 ∕ 25.” That is Drupal’s own advisory rating, not a CVSS score. Drupal.org lists basic attack complexity, some confidentiality and integrity impact, theoretical exploit maturity, and uncommon target distribution. The advisory is dated September 23, 2026.
Which Webform versions are affected?
| Installed branch | Affected versions | Drupal.org recommended fixed release |
|---|---|---|
| 6.2.x | Earlier than 6.2.12 | 6.2.12 |
| 6.3.x | 6.3.0 and later versions below 6.3.1 | 6.3.1 |
These ranges and targets come from Drupal.org’s Webform security advisory SA-CONTRIB-2026-154. The advisory does not specify other branches in the affected-version ranges above. Check the live advisory for updates before acting, especially if your installed version or branch does not fit these entries.
#1 Best Overall
How to assess and remediate exposure
- Identify the Webform version installed on each Drupal site that uses the module. Use your normal module inventory or deployment process to confirm the version actually running; do not infer it from a development copy or a package manifest that may not match production.
- Compare it with the affected ranges. A version below 6.2.12 on the 6.2.x branch, or 6.3.0 on the 6.3.x branch, falls within the ranges Drupal.org identifies as affected.
- Upgrade to the branch’s recommended release. Drupal.org recommends 6.2.12 for the 6.2.x branch and 6.3.1 for the 6.3.x branch. Follow your organization’s normal change controls and deployment process.
- Verify the deployed version. After deployment, check the production site’s Webform version and confirm it is at least the stated fixed release for that branch. Record the result for each affected site.
- Recheck the advisory. Confirm the affected ranges and fixed-release guidance against the live Drupal.org advisory, which may be updated.
What should you monitor for?
Drupal.org’s advisory does not provide CVE-specific indicators of compromise, log signatures, detection rules, or monitoring steps. It therefore does not support claims that a particular product, query, or signature detects CVE-2026-96360. The grounded way to assess exposure is to inventory Webform versions and verify remediation; do not treat the absence of a particular log entry as proof that a site was not affected.
The advisory provides no CVE-specific monitoring artifact to search for. If you already have broader XSS monitoring or incident-response procedures, they may be relevant to your environment, but this advisory does not validate a particular alert, event pattern, or log source for this vulnerability.
Rank #2
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
What the advisory does—and does not—establish
- Established: the affected component is Drupal Webform; the issue is XSS associated with crafted announcement text in some configurations; and Drupal.org lists the affected ranges and branch-specific fixed releases above.
- Not stated: a CVSS score, CVE-specific indicators of compromise, log signatures, or detection rules.
- Not established by the advisory: that a given site was exploited, or that a particular monitoring tool can identify exploitation of this CVE.
Drupal.org names Pierre Rudloff of the Drupal Security Team as reporter, and Jacob Rockowitz and Lee Rowlands as fixers. These attributions do not provide a separate detection method or a direct quotation from those individuals.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
