CVE-2026-96375

MediumCVSS 4.8

Published: 22/10/2026(UTC)Updated: 22/10/2026(UTC)Translated: 22/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.09%

1th percentile - higher than 1% of all known CVEs

Summary

The Drupal Cloud module contains an improper certificate validation vulnerability enabling an Adversary in the Middle (AiTM) attack. The issue affects versions from 0.0.0 to 7.0.1.

Risk Assessment

An attacker positioned between client and server could intercept or modify communication, potentially leading to data leakage or session compromise.

Recommendation

Update the Cloud module to a version later than 7.0.1 that includes the certificate validation fix.

Other vulnerabilities in Drupal Cloud

CVE-2026-96376Medium
Drupal Cloud contains an OS Command Injection vulnerability due to improper neutralization of special elements used in OS commands. This issue affects Cloud versions from 0.0.0 to 7.0.1.

Original NVD description (English source)

Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects Cloud versions: from 0.0.0 to 7.0.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS