Executive Summary

On September 23^rd, 2026, the Drupal Security Team published advisories addressing 36 vulnerabilities across 16 modules, including five rated critical. Among the most serious is CVE-2026-96355 affecting the widely used Webform module. Given the breadth and severity of these disclosures, organizations running Drupal should review their installations and update any affected modules before attackers weaponize these vulnerabilities. 

The vulnerabilities associated with the released advisories enable attackers to perform a multitude of attacks, including remote code execution, stored cross-site scripting, and authorization bypasses. The updates released by Drupal resolve all these vulnerabilities across the modules. 

Although active exploitation has not been reported and no public proof-of-concept exploits are known at the time of writing, critical Drupal vulnerabilities have historically been weaponized following disclosure. For example, 2018's "Drupalgeddon2" was exploited at scale shortly after disclosure. Beazley Security recommends affected organizations apply available fixes as soon as possible, prioritizing Webform and Cloud. 

Affected Systems or Products

Additional Vulnerabilities in the September 23^rd Release

The same release fixed 31 further vulnerabilities in 13 modules, which Drupal rated as moderately critical. Most require an attacker to already hold an authenticated role or depend on a specific site configuration. Webform accounts for 19 of them, and the same Webform upgrade that fixes CVE-2026-96355 resolves all of them. 

Two of these fixes require follow-up: 

1. 1.

   The Webform update adds a new Administer webform remote post URLs permission, which should be granted only to trusted roles. 

2. 2.

   Commerce Decoupled Checkout now rejects custom order fields outside an allowlist, so sites that submit additional fields must enable them at /admin/commerce/config/decoupled-checkout before resuming checkout. 

Mitigations / Workarounds

Upgrading to fixed versions remediates every vulnerability in this advisory. One Webform upgrade addresses CVE-2026-96355 and its 19 sibling issues, and Cloud 7.0.1 fixes both Cloud vulnerabilities. 

• 

  Webform: 6.2.12 for the 6.2.x branch, or 6.3.1 for the 6.3.x branch 

• 

  Cloud: 7.0.1 

• 

  Project Browser: 2.0.3 for the 2.0.x branch, or 2.1.5 for the 2.1.x branch 

• 

  tawk.to Live Chat: 3.0.4 

After upgrading, complete these steps: 

1. 1.

   Run Drupal database updates and rebuild caches, as the Cloud and tawk.to advisories require cache rebuilds. 

2. 2.

   For Cloud sites that use a private certificate authority (CA), configure the CA certificate path for each Kubernetes and VMware connection or ensure the PHP runtime trusts the issuing CA. Cloud 7.0.1 enables certificate verification, and connections will fail without this step. 

If organizations cannot upgrade immediately, the following steps may temporarily reduce risk: 

1. 1.

   Identify webforms that use a custom multiple-value item format containing submission-value tokens and remove those formats until Webform is updated. Only webforms configured this way are exposed to CVE-2026-96355. 

2. 2.

   Disable the Cloud Kubernetes submodule where it is not in use. Otherwise, restrict permission to add or edit cloud server templates, and the launch cloud server template permissions, to trusted administrators. 

3. 3.

   Uninstall Project Browser from production sites that do not need it. 

These workarounds change site behavior and do not address the cross-site request forgery (CSRF) issue in tawk.to, so treat them as short-term measures only. 

Patches

The Drupal Security Team has released fixed versions of all affected modules, available from each module's project page on drupal.org. Additional information can be found in the individual Drupal advisories listed below. 

Technical Details

One of the most critical flaws released, CVE-2026-96355, stems from how Webform renders submissions. Site builders can define custom display formats for fields that accept multiple values, and those formats can include tokens that insert submitted values. Webform does not exclude these format templates from token replacement. As a result, text an attacker enters into a form is inserted into the template and evaluated as template code when the submission is displayed. What that evaluation achieves depends on the site's configuration and enabled modules, ranging from data exposure to code execution on the server. At the time of writing, it’s unclear whether a common pathing and module configuration enables a generic exploitation of this token replacement issue. 

In the Cloud module, CVE-2026-96376 is an operating system command injection. The Kubernetes integration passes the Git branch and repository URL values from cloud server templates to shell commands without sanitization. An attacker who can edit a template can also run commands as the web server user. Exploitation requires the Kubernetes submodule to be enabled and Git to be present on the server. Drew Webber of the Drupal Security Team reported the flaw. 

CVE-2026-96375 is a missing TLS certificate check in the Kubernetes and VMware integrations, which lets an attacker who can intercept those connections capture API tokens and other credentials. 

CVE-2026-96374 and CVE-2026-96388 are missing CSRF protections on actions in Project Browser and tawk.to. Drupal has not published further technical detail, and no public proof-of-concept exploits are known. 

How Beazley Security is responding

Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found. 

We are also conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients. 

If you believe your organization may have been impacted by this attack campaign and need support, please contact our Incident Response team.

Sources

• 

  https://nvd.nist.gov/vuln/detail/CVE-2026-96355 

• 

  https://nvd.nist.gov/vuln/detail/CVE-2026-96388 

• 

  https://nvd.nist.gov/vuln/detail/CVE-2026-96374 

• 

  https://nvd.nist.gov/vuln/detail/CVE-2026-96376 

• 

  https://nvd.nist.gov/vuln/detail/CVE-2026-96375 

• 

  https://www.drupal.org/sa-contrib-2026-175 

• 

  https://www.drupal.org/sa-contrib-2026-184 

• 

  https://www.drupal.org/sa-contrib-2026-178 

• 

  https://www.drupal.org/sa-contrib-2026-177 

• 

  https://www.drupal.org/sa-contrib-2026-176