Check CVE-2026-96364 by comparing each site’s installed Drupal Webform version with the affected releases, then inspecting Webform Share and the configuration of any relevant form. Drupal’s advisory describes an anti-spam bypass only under a specific combination of conditions; it does not publish a CVE-specific remote scan signature that can prove a live site is exploitable.
What CVE-2026-96364 affects
CVE-2026-96364 is a moderately critical access bypass in the contributed Drupal webform project, tracked by Drupal as SA-CONTRIB-2026-171. It is not a Drupal core advisory. Drupal rates the issue 14/25; that is the advisory’s risk rating, not a CVSS score or a measure of how many sites are exposed.
As an Amazon Associate I earn from qualifying purchases.
The described behavior is narrow: under certain circumstances, submissions to an Ajax-enabled Webform shared through Webform Share can bypass anti-spam protections. Drupal’s advisory identifies the relevant conditions and fixes, while OSV’s record corroborates the affected version ranges.
Which Webform versions are affected?
| Installed Webform branch | Affected versions | Fixed release |
|---|---|---|
| 6.2.x | Earlier than 6.2.12 | 6.2.12 |
| 6.3.x | 6.3.0, but earlier than 6.3.1 | 6.3.1 |
These ranges are for the contributed Webform module, not Drupal core. A version outside the ranges listed for this advisory is not identified as affected by CVE-2026-96364; that does not establish that the site is free of other security issues.
#1 Best Overall
How to assess a live Drupal estate
Use internal inventory and configuration evidence as the primary check. Assess every site and environment separately, including staging and other deployed copies that may not match production.
- Inventory Webform versions. Record the installed Webform branch and exact version for each site and environment. Compare each version with the affected ranges above, keeping the 6.2.x and 6.3.x branches distinct.
- Check the relevant configuration on sites with an affected version. Determine whether Webform Share is enabled, sharing is enabled for the particular form, and that form uses compatible Form-API-based anti-spam protection such as Honeypot or Antibot. Assess these as cumulative conditions from Drupal’s advisory; the presence of one module alone does not prove exposure.
- Prioritize forms matching the full scenario. For each shared form, establish whether it is Ajax-enabled and uses the compatible anti-spam protection described by Drupal. This is the configuration combination relevant to the advisory, rather than simply whether a site contains a Webform.
- Upgrade along the installed branch. Update Webform 6.2.x to 6.2.12 or Webform 6.3.x to 6.3.1, following the project’s normal deployment process.
- Verify after deployment. Confirm the installed package and version on the deployed site, review the relevant form and sharing settings again, and retain the inventory and deployment record. This verifies version and configuration against the advisory; it is not an exploit-reproduction test.
What remote scans and logs cannot establish
Drupal’s published advisory gives affected versions, configuration prerequisites, impact, and fixes, but does not document a request signature, payload, log query, or official remote probe for confirming exploitability. A generic scanner’s clean result—or the absence of suspicious requests in logs—therefore cannot establish that the relevant configuration is safe.
Rank #2
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
This is a limit of what the cited advisory publishes, not proof that no third-party detection method exists. For an operational assessment, rely on the internal version and form-configuration checks rather than treating an unauthenticated web scan as the primary test.
Recommended Free Tools
Evidence to retain for each site
- Site and environment identifier, with the installed Webform branch and version.
- Whether Webform Share is enabled and which forms have sharing enabled.
- For each relevant shared form, whether it is Ajax-enabled and uses compatible Form-API anti-spam protection.
- The deployed fixed version and date of verification, if upgraded.
Drupal’s contributed-project advisory catalog also associates the CVE with SA-CONTRIB-2026-171. Recheck the Drupal advisory when making remediation decisions because advisory and version records can change.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
