cPanel, WHM Release Fixes for Three New Vulnerabilities — Patch Now
Vulnerability: cPanel and WHM patch three high-severity vulnerabilities enabling privilege escalation, code execution, and denial-of-service.
Deep Analysis and Expert Commentary
The vulnerabilities in cPanel and WHM highlight systemic risks in web hosting control panels. CVE-2026-29202 stands out due to its potential for arbitrary Perl code execution via the 'create_user API' call, requiring only authenticated access. Attackers could chain this with CVE-2026-29203's symlink manipulation to escalate privileges or disrupt services. The affected versions span multiple releases, indicating a widespread impact. Mitigation requires immediate patching to versions 11.136.0.9 or higher, with special attention to legacy systems like CentOS 6. Organizations should also monitor for suspicious API calls and file permission changes, as these could indicate exploitation attempts.
Action Items
- Patch cPanel and WHM to the latest versions immediately.
- Monitor for unusual API calls or file permission changes.
- Update legacy systems (CentOS 6, CloudLinux 6) to version 110.0.114.
Original Article Brief Intro
The Hacker News · 2026-05-09 · Vulnerability: cPanel and WHM patch three high-severity vulnerabilities enabling privilege escalation, code execution, and denial-of-service.
Related Terms and Notes
CVE IDs
- CVE-2026-29201 — Insufficient input validation in cPanel's 'feature::LOADFEATUREFILE' allowing arbitrary file reads.
- CVE-2026-29202 — Insufficient input validation in 'create_user API' enabling arbitrary Perl code execution.
- CVE-2026-29203
- CVE-2026-41940
Techniques / TTPs
- Privilege Escalation
- RCE
Context Notes
- cPanel
- cPanel vulnerabilities
- DoS
- WHM patches