CVE-2026-96376

MediumCVSS 6.4

Published: 22/10/2026(UTC)Updated: 23/10/2026(UTC)Translated: 22/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.57%

47th percentile - higher than 47% of all known CVEs

Summary

Drupal Cloud contains an OS Command Injection vulnerability due to improper neutralization of special elements used in OS commands. This issue affects Cloud versions from 0.0.0 to 7.0.1.

Risk Assessment

An attacker can execute arbitrary OS commands on the server, potentially leading to full host compromise and data theft.

Recommendation

Update the Drupal Cloud module to a version later than 7.0.1 and review logs for suspicious commands.

Other vulnerabilities in Drupal Cloud

CVE-2026-96375Medium
The Drupal Cloud module contains an improper certificate validation vulnerability enabling an Adversary in the Middle (AiTM) attack. The issue affects versions from 0.0.0 to 7.0.1.

Original NVD description (English source)

Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Cloud allows OS Command Injection. This issue affects Cloud versions: from 0.0.0 to 7.0.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS