cPanel and WHM Patch Critical Vulnerabilities to Prevent RCE and Privilege Escalation

cPanel, WHM Release Fixes for Three New Vulnerabilities — Patch Now

cPanel and Web Host Manager (WHM) have issued critical updates to address three security flaws across multiple versions. Two of these vulnerabilities carry high-severity CVSS scores of 8.8, posing immediate risks of code execution and system compromise.

Why This Matters

In ideal infrastructure models, system management tools like cPanel provide isolated environments for user operations. However, technical reality reveals that insufficient input validation and unsafe symlink handling can bypass these boundaries, allowing authenticated users to execute Perl code or modify arbitrary file permissions. With threat actors actively weaponizing previous cPanel flaws to deploy Mirai botnets and ransomware, the failure to patch these specific vulnerabilities could result in full server takeover or service-wide denial-of-service.

Key Insights

• CVE-2026-29202 (CVSS 8.8) allows arbitrary Perl code execution via insufficient input validation of the plugin parameter in create_user API calls.
• CVE-2026-29203 (CVSS 8.8) enables privilege escalation or denial-of-service through unsafe symlink handling during chmod operations.
• CVE-2026-29201 (CVSS 4.3) facilitates arbitrary file reads by exploiting insufficient validation of feature file names in adminbin calls.
• Threat actors recently exploited CVE-2026-41940 as a zero-day to distribute Mirai botnet variants and the Sorry ransomware strain.
• Patch coverage extends to legacy systems, with version 110.0.114 specifically released for CentOS 6 and CloudLinux 6 environments.

Practical Applications

• Use case: Enterprise hosting environments must deploy WHM version 11.136.0.9 or higher to maintain secure multi-tenant isolation. Pitfall: Delayed patching allows authenticated users to escalate privileges via symlink manipulation.
• Use case: WordPress-focused hosts using WP Squared should upgrade to version 11.136.1.10 to secure the create_user API. Pitfall: Unvalidated plugin parameters in automated provisioning scripts can lead to arbitrary code execution.

References:

• http://thehackernews.com/2026/05/cpanel-whm-patch-3-new-vulnerabilities.html