{"id":863,"date":"2026-05-09T08:15:31","date_gmt":"2026-05-09T08:15:31","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=863"},"modified":"2026-05-09T08:15:31","modified_gmt":"2026-05-09T08:15:31","slug":"cpanel-whm-release-fixes-for-three-new-vulnerabilities-patch-now","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=863","title":{"rendered":"cPanel, WHM Release Fixes for Three New Vulnerabilities \u2014 Patch Now"},"content":{"rendered":"<div>\n<p><span class=\"p-author\"><i class=\"icon-font icon-user\">\ue804<\/i><span class=\"author\">Ravie Lakshmanan<\/span><i class=\"icon-font icon-calendar\">\ue802<\/i><span class=\"author\">May 09, 2026<\/span><\/span><span class=\"p-tags\">Vulnerability \/ Web Hosting<\/span><\/p>\n<\/div>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEj8HLwOMzo20kbZmflPvJJmY7su6wWOWgDLV-dJNx-k76m5ivbwVoCkFrnsLXkyO4PHAyLSkPXinjK71SDmWabyOcTlKb3juZgkXTzOVuMvZk6-LUFMhoJ-UGFvv0qEby7QmYcjTWn1m1L19VTKeB7CdmKvpvIP5ifniLO92ARSLjtf8rcXIbm8AFMZei-M\/s1700-e365\/cpanel-3.jpg\" style=\"display: block;  text-align: center; clear: left; float: left;\"><\/a><\/div>\n<p>cPanel has released updates to address three vulnerabilities in cPanel and Web Host Manager (WHM) that could be exploited to achieve privilege escalation, code execution, and denial-of-service.<\/p>\n<p>The list of vulnerabilities is as follows &#8211;<\/p>\n<ul>\n<li><strong><a href=\"https:\/\/support.cpanel.net\/hc\/en-us\/articles\/40311033698327-Security-CVE-2026-29201-cPanel-WHM-WP2-Security-Update-May-08-2026\">CVE-2026-29201<\/a><\/strong> (CVSS score: 4.3) &#8211; An insufficient input validation of the feature file name in the \u00abfeature::LOADFEATUREFILE\u00bb adminbin call that could result in an arbitrary file read.<\/li>\n<li><strong><a href=\"https:\/\/support.cpanel.net\/hc\/en-us\/articles\/40311426610327-Security-CVE-2026-29202-cPanel-WHM-WP2-Security-Update-May-08-2026\">CVE-2026-29202<\/a><\/strong> (CVSS score: 8.8) &#8211; An insufficient input validation of the \u00abplugin\u00bb parameter in the \u00abcreate_user API\u00bb call that could result in arbitrary Perl code execution on behalf of the already authenticated account&#8217;s system user.<\/li>\n<li><strong><a href=\"https:\/\/support.cpanel.net\/hc\/en-us\/articles\/40311543760407-Security-CVE-2026-29203-cPanel-WHM-WP2-Security-Update-May-08-2026\">CVE-2026-29203<\/a><\/strong> (CVSS score: 8.8) &#8211; An unsafe symlink handling vulnerability that allows a user to modify access permissions of an arbitrary file using chmod, resulting in denial-of-service or possible privilege escalation.<\/li>\n<\/ul>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/ai-cant-stop-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjPEV6-530TOlxG6PjrmdlY623wpBwduZ7t1HV6flcmO5R4q4AmfixDUzW0CrhlvMVNWbhvOIso-UDNTka4W_W9Chrdj_dglwBZwi7DuePM2IMIl-hfUYVIqBXgfpr_2619K8Gptb4LzwJ6gUbi7lWl2M8AFQJsHEaw63Q7tZ6708YGruiHrr0Y2W9YYxLQ\/s728-e100\/ThreatLocker-d.png\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>The shortcomings have been patched in the following versions &#8211;<\/p>\n<ul>\n<li>cPanel and WHM &#8211;\n<ul>\n<li>11.136.0.9 and higher<\/li>\n<li>11.134.0.25 and higher<\/li>\n<li>11.132.0.31 and higher<\/li>\n<li>11.130.0.22 and higher<\/li>\n<li>11.126.0.58 and higher<\/li>\n<li>11.124.0.37 and higher<\/li>\n<li>11.118.0.66 and higher<\/li>\n<li>11.110.0.116 and higher<\/li>\n<li>11.110.0.117 and higher<\/li>\n<li>11.102.0.41 and higher<\/li>\n<li>11.94.0.30 and higher<\/li>\n<li>11.86.0.43 and higher<\/li>\n<\/ul>\n<\/li>\n<li>WP Squared &#8211;\n<\/li>\n<\/ul>\n<p>cPanel has released 110.0.114 as a direct update for customers who are still on CentOS 6 or CloudLinux 6. Users are advised to update to the latest versions for optimal protection.<\/p>\n<p>While there is no evidence that the vulnerabilities have been exploited in the wild, the disclosure comes days after another critical flaw in the product (CVE-2026-41940) has been weaponized by threat actors as a zero-day to deliver Mirai botnet variants and a ransomware strain called Sorry.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>\ue804Ravie Lakshmanan\ue802May 09, 2026Vulnerability \/ Web Hosting cPanel has released updates to address three vulnerabilities in cPanel and Web Host Manager (WHM) that could be exploited to achieve privilege escalation,&hellip;<\/p>\n","protected":false},"author":1,"featured_media":864,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[1465,655,348,1588,474,1587],"class_list":["post-863","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-cpanel","tag-fixes","tag-patch","tag-release","tag-vulnerabilities","tag-whm"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/863","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=863"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/863\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/864"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=863"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=863"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=863"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}