Update affected Webform installations to the fixed release for their branch: Webform 6.2.x to 6.2.12, or Webform 6.3.x to 6.3.1. Drupal’s September 23, 2026 advisory, SA-CONTRIB-2026-159, rates CVE-2026-96359 as a moderately critical cross-site scripting (XSS) issue with a risk score of 12/25. Drupal says core is not affected by the contributed-project release. The larger WID-SEC-2026-3554 batch description circulating in a secondary article is not fully confirmed by the official Drupal material discussed here.
What CVE-2026-96359 affects
Drupal’s SA-CONTRIB-2026-159 identifies CVE-2026-96359 as an XSS vulnerability in the contributed Webform module. Webform lets site builders create forms, collect submissions, and configure access to forms and submission data. The issue concerns attributes used by Webform’s color element: under certain conditions, specially crafted attributes can lead to XSS when that element is rendered.
As an Amazon Associate I earn from qualifying purchases.
The advisory states a specific prerequisite: an attacker must be able to add a specially crafted link with a particular class to the same page as the affected webform. That condition matters; the advisory does not say that every installation is exploitable in the same way. Drupal assigns this issue a moderately critical rating and a risk score of 12/25.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Which Webform versions need an update?
Drupal lists the affected ranges and corresponding fixed releases in SA-CONTRIB-2026-159:
#1 Best Overall
| Installed Webform branch | Affected versions | Fixed release |
|---|---|---|
| 6.2.x | Below 6.2.12 | 6.2.12 |
| 6.3.x | 6.3.0 and below 6.3.1 | 6.3.1 |
Use the target for your installed branch: the advisory does not tell operators to move from 6.2.x to 6.3.x. If the deployed version is outside the ranges shown, the cited advisory does not establish its status; check the current Webform security advisory and any later release notes before deciding it is unaffected.
How to patch and verify Webform
Drupal’s September 23, 2026 public service announcement says no special release procedure is required and directs site owners to use their normal update procedures. Apply the update through your site’s established change and deployment process.
Rank #2
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
- Inventory the installation. Identify the Webform version actually deployed on each site, including production and any other environments that receive traffic. Record the branch as well as the version.
- Match the branch to the advisory. Compare the deployed version with the affected ranges in SA-CONTRIB-2026-159. For an affected 6.2.x installation, target 6.2.12; for an affected 6.3.x installation, target 6.3.1.
- Plan the release using your normal process. Review the update in the usual way for your site, then deploy it through the same release controls used for other Drupal contributed-module updates. The PSA says these releases are not covered by Drupal Steward.
- Verify the live deployment. After release, confirm the running application reports the intended fixed Webform version. Check the production deployment, not only a development or staging copy.
- Keep an operational record. Note the deployed version and update time so the team can distinguish patched sites from sites still awaiting release.
The advisory specifies fixed versions but does not prescribe an organization-specific testing, backup, or rollback plan. Follow the controls already used for your application rather than treating a version number as proof that the live deployment has changed.
Does this affect Drupal core?
No. Drupal’s September 23, 2026 public service announcement says, “Drupal core is not affected.” CVE-2026-96359 is identified in the Webform contributed module, so the immediate fix described by SA-CONTRIB-2026-159 is a Webform update, not a Drupal core update.
The PSA also says the contributed-project releases are not covered by Drupal Steward. That is a coverage qualification, not a different patching instruction: the announcement directs site owners to follow normal update procedures.
What is confirmed about the wider WID-SEC-2026-3554 batch?
Drupal’s September 23 PSA described a planned release window for contributed-project security advisories. It said advisories might appear at different times or be grouped by module, and that other contributed projects could publish advisories as well. The official Drupal feed excerpt for that date shows separate advisories across multiple projects and separate Webform issues.
A DEV Community article dated September 29 claims that CERT-BUND identifier WID-SEC-2026-3554 covers 36 CVEs, from CVE-2026-96355 through CVE-2026-96398, across 16 contributed projects. The official Drupal material cited here does not establish that exact mapping or complete project inventory. Treat those batch totals, the article’s fixed-version list, and its batch-level severity and exposure figures as unverified until the original CERT-BUND record or another authoritative record confirms them.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallDrupal’s feed lists, among other items, a separate critical Webform remote-code-execution advisory for CVE-2026-96355 and a separate less-critical Webform access-bypass advisory for CVE-2026-96398. Those are not CVE-2026-96359. Their conditions and severity should not be transferred to the XSS issue or used to imply that every item in the release window has the same impact.
Best Value
How to triage the rest of the contributed-project releases
Do not patch or rank projects based on an unverified batch summary. For each installed contributed project, use that project’s own Drupal advisory to determine whether the deployed version is affected and what release fixes it.
- Inventory the contributed projects installed on the site and their deployed versions.
- Match each project to its individual advisory and affected-version range.
- Record the issue type, stated severity, exploitation prerequisites, and fixed version from that advisory.
- Prioritize according to the advisory and the project’s actual exposure on your site; do not assume one batch-wide impact applies to every issue.
- Update and verify each affected project through the site’s normal release process.
Drupal’s September 23 announcement confirms a broader contributed-project release context, but it does not, by itself, verify the secondary article’s full WID-SEC-2026-3554 inventory. The exact set of projects, CVEs, and fixed releases assigned to that identifier remains unestablished by the official Drupal material cited here.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
