Drupal Cloud CVE-2026-96376

Exploitation requires (1) a low-privileged authenticated account on the target site per PR:L, (2) the Drupal 'Cloud' contributed module installed and enabled (it is not part of Drupal core, so sites without it are unaffected), (3) a running version in the range 0.0.0 up to but not including 7.0.1, and (4) user interaction (UI:R) to trigger the vulnerable action. The attack is further limited by high attack complexity (AC:H), meaning conditions beyond the attacker's direct control must be met. The specific module feature, protocol, or configuration setting that passes unsanitized input to the OS command is not described in the available sources. The only complete remediation per the vendor advisory is updating to the fixed release (7.0.1 or later).

This is a moderate-severity OS command injection (CWE-78) in the Drupal 'Cloud' contributed module, scored CVSS 6.4. The provided vector (AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) describes a network-reachable flaw that nonetheless carries three meaningful attacker burdens simultaneously: high attack complexity (AC:H), an authenticated account (PR:L), and required user interaction (UI:R). These constraints are what hold the score at Medium despite high confidentiality and integrity impact. The supporting signals are consistent with a non-urgent priority rather than a crisis: EPSS is 0.63% (50th percentile - unremarkable, average probability of exploitation), the vulnerability is NOT on the CISA KEV list, and no public exploit or proof-of-concept reference is present in the input (the only references are the Drupal vendor advisory SA-CONTRIB-2026-177 and an NVD detail page). The vuln.today decision label is 'this_month', not act_now or emergency, which aligns with the combined low-EPSS/no-KEV/no-POC picture. One note on internal consistency: the published vector sets A:N, yet OS command injection by definition grants arbitrary command execution, which would normally also carry an availability impact - this is a minor divergence worth verifying against the vendor advisory, but it does not change the overall priority. No SSVC exploitation/automatable/technical-impact decision points were supplied, so that framework cannot be cross-referenced. Overall: a genuine but conditional vulnerability (authenticated + interaction + high complexity) that should be patched on a normal cycle, not a drop-everything emergency.

An attacker who already holds a low-privileged authenticated account on a Drupal site running the Cloud module supplies crafted input into a cloud-management operation that is improperly neutralized and passed to an OS command. Because the CVSS vector requires user interaction (UI:R) and high complexity (AC:H), success also depends on luring a user or administrator into triggering the affected action and on conditions the attacker does not fully control. No public exploit or proof-of-concept exploit code is identified in the available sources; the trigger mechanism is not described in the advisory data provided.