What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
No: a zero result for vul.cve="CVE-2026-96365" does not prove your Drupal site is safe. It means the reported ZoomEye query found no matching indexed assets. Actual exposure depends on the Webform version and configuration on the systems you operate.
What CVE-2026-96365 affects
Drupal’s advisory, SA-CONTRIB-2026-170, describes a denial-of-service flaw in the Webform module. As the advisory puts it, “Webform does not sufficiently validate an optional token query value before using it.” Under specific configurations, a malicious request can consume significant resources when a Webform is rendered for anonymous visitors. This is a conditional risk, not a claim that every Drupal site is vulnerable.
As an Amazon Associate I earn from qualifying purchases.
| Webform branch | Affected versions | Fixed version |
|---|---|---|
| 6.2.x | Below 6.2.12 | 6.2.12 |
| 6.3.x | 6.3.0 through versions below 6.3.1 | 6.3.1 |
The Drupal Security Team rates the issue “Less critical 8 ∕ 25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:Uncommon.” That is Drupal’s advisory rating and notation; it should not be treated as a score from another rating system. The advisory was published September 23, 2026.
What the reported zero does—and does not—show
A query result describes a particular search against an external index at a particular time. A secondary article on DEV Community reported that on September 27, 2026, the query app="Drupal" returned 436403 assets, while vul.cve="CVE-2026-96365" returned zero. These are the article’s reported query results, not independently verified current counts.
- The 436403 result is a reported application-query count. It does not identify which assets use Webform or whether their versions are affected.
- The zero is a reported vulnerability-query result. It does not establish that no vulnerable installations exist or that the index covers every relevant system.
- Neither figure is a victim count, a census of affected Webform sites, or an inventory of your own infrastructure.
NIST describes the National Vulnerability Database as a repository of vulnerability information whose CVE detail records can include affected software configuration data. Such records help identify products and versions; they do not inventory an individual organization’s software estate or prove that a public scanner recognizes every affected installation. See NIST’s NVD overview.
Quick Recap
How to assess your own Drupal sites
- Inventory the environments you operate. Include production, staging, and less frequently maintained Drupal deployments.
- Check each installed Webform version. Compare it with the affected ranges in the Drupal advisory: below 6.2.12 on the 6.2 branch, or 6.3.0 through below 6.3.1 on the 6.3 branch.
- Review the relevant configuration. The advisory describes risk where a Webform is rendered for anonymous visitors. Check whether that condition applies to your site.
- Update affected installations. Move 6.2.x installations to 6.2.12 and 6.3.x installations to 6.3.1, following the advisory and your site’s release process.
- Record the outcome. Keep the installed version and update status for each relevant environment; do not use an external search result as a substitute for that record.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
