CVE-2026-96357: 436,263 Drupal instances exposed

CERT-BUND advisory WID-SEC-2026-3554, published September 23, 2026, rates CVE-2026-96357 at CVSS 9.8 and covers 16 contributed Drupal projects across 19 version ranges, including Webform and Project Browser. ZoomEye counted 436,263 reachable Drupal instances, but that figure measures exposure, not confirmed vulnerable deployments.

• CVSS v3.1 base score 9.8, temporal 8.5; fixes are available
• 16 contributed Drupal projects affected across 19 version ranges
• ZoomEye: 436,263 Drupal instances reachable as of Sept 25, 2026
• ZoomEye query for CVE-2026-96357 returned no results