Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). (CVE-2026-96375)

CVE-2026-96375 describes an improper certificate validation vulnerability in Drupal Cloud that enables adversaries to conduct man-in-the-middle attacks. The vulnerability affects all cloud versions from 0.0.0 up to and including 7.0.1. The CVSS 3.1 base score is 4.8, indicating medium severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity but not availability. No patch or official remediation details are provided in the available data.

Successful exploitation could allow an attacker to intercept and potentially manipulate communications between users and the Drupal Cloud service, impacting confidentiality and integrity of data. However, the attack complexity is high, and no privileges or user interaction are required. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or workaround information is provided, users should monitor official Drupal Cloud advisories for updates. No specific mitigation steps are currently documented.