Webpros Cpanel vulnerabilities

CVE-2026-41940 [CRITICAL] CWE-306 CVE-2026-41940: cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

CVE-2026-67401 [CRITICAL] CWE-89 CVE-2026-67401: A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root thr A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component

CVE-2026-93698 [CRITICAL] CWE-78 CVE-2026-93698: Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin. Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.

CVE-2026-58048 [CRITICAL] CWE-89 CVE-2026-58048: Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context.

CVE-2026-65643 [HIGH] CWE-95 CVE-2026-65643: Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitra Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.

CVE-2026-29202 [HIGH] CWE-94 CVE-2026-29202: Insufficient input validation of the `plugin` parameter of the `create_user` plugin allows arbitrary Insufficient input validation of the `plugin` parameter of the `create_user` plugin allows arbitrary Perl code execution on behalf of the already authenticated account's system user.

CVE-2026-29203 [HIGH] CWE-61 CVE-2026-29203: A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system files or directories. That can cause DoS or local privilege escalation when an authenticated cPanel user places a symlink at a user-controlled legacy Nova path under their home directory.

CVE-2026-87899 [CRITICAL] CWE-250 CVE-2026-87899: Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitra Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges.

CVE-2026-29205 [HIGH] CWE-250 CVE-2026-29205: Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.

CVE-2026-32993 [HIGH] CWE-93 CVE-2026-32993: Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint allo Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint allows unauthenticated attacker to inject arbitrary HTTP header to the response.

CVE-2026-29201 [HIGH] CWE-23 CVE-2026-29201: Insufficient input validation of the feature file name in `feature::LOADFEATUREFILE` adminbin call c Insufficient input validation of the feature file name in `feature::LOADFEATUREFILE` adminbin call can cause arbitrary file read when a relative file path is passed.

CVE-2026-93029 [CRITICAL] CWE-79 CVE-2026-93029: There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts in There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.

CVE-2026-93697 [CRITICAL] CWE-79 CVE-2026-93697: There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Account There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.

CVE-2026-29206 [HIGH] CWE-89 CVE-2026-29206: Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL Injections Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL Injections on behalf of the root user if Slow Query logging is enabled.

CVE-2026-32992 [HIGH] CWE-295 CVE-2026-32992: SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to m SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle the request and capture credentials.

CVE-2026-32991 [HIGH] CWE-863 CVE-2026-32991: Improper authorization checks of team members privileges allow a team member to escalate privileges Improper authorization checks of team members privileges allow a team member to escalate privileges to the team owner account.

CVE-2026-68490 [HIGH] CWE-732 CVE-2026-68490: Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information be Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts.

CVE-2026-58047 [MEDIUM] CWE-444 CVE-2026-58047: HTTP Smuggling in cPanel allows potential leak of credentials. HTTP Smuggling in cPanel allows potential leak of credentials.