PatchTheCVEcpanel vulnerabilities and fixes
Recent CVEs affecting cpanel, with upgrade or downgrade steps. 4 tracked.
cpanel has 4 tracked vulnerabilities, 1 critical and 1 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 4. Most recent: 2026-09-01. Highest priority: CVE-2026-41940 (score 100/100).
- CVE-2026-41940 CRITICAL 9.8 EXPLOITED UPGRADE UPGRADE WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability
- CVE-2026-29205 HIGH 8.6 UPGRADE UPGRADE Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via
- CVE-2026-32992 HIGH 8.2 UPGRADE UPGRADE SSL verification is disabled in the DNS Cluster system
- CVE-2026-65643 HIGH 8.8 UPGRADE Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as
FAQ
How do I fix cpanel vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is cpanel being exploited right now?
Yes: 1 cpanel CVE is on the CISA Known Exploited Vulnerabilities list, so patch it first.
Which cpanel CVE should I patch first?
CVE-2026-41940 currently ranks highest (100/100): WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability.