cPanel, WHM Patch 3 New Vulnerabilities After Zero-Day Exploitation

"cPanel has released updates to address three vulnerabilities in cPanel and Web Host Manager (WHM) that could be exploited to achieve privilege escalation, code execution, and denial-of-service. The list of vulnerabilities is as follows - CVE-2026-29201 (CVSS score: 4.3) - An insufficient input validation of the feature file name in the "feature::LOADFEATUREFILE" adminbin call that could result in an arbitrary file read. CVE-2026-29202 (CVSS score: 8.8) - An insufficient input validation of the "plugin" parameter in the "create_user API" call that could result in arbitrary Perl code execution on behalf of the already authenticated account's system user. CVE-2026-29203 (CVSS score: 8.8) - An unsafe symlink handling vulnerability that allows a user to modify access permissions of an arbitrary file using chmod, resulting in denial-of-service or possible privilege escalation."

"CVE-2026-29201 (CVSS score: 4.3) - An insufficient input validation of the feature file name in the "feature::LOADFEATUREFILE" adminbin call that could result in an arbitrary file read. CVE-2026-29202 (CVSS score: 8.8) - An insufficient input validation of the "plugin" parameter in the "create_user API" call that could result in arbitrary Perl code execution on behalf of the already authenticated account's system user. CVE-2026-29203 (CVSS score: 8.8) - An unsafe symlink handling vulnerability that allows a user to modify access permissions of an arbitrary file using chmod, resulting in denial-of-service or possible privilege escalation."

"The shortcomings have been patched in the following versions - cPanel and WHM - 11.136.0.9 and higher 11.134.0.25 and higher 11.132.0.31 and higher 11.130.0.22 and higher 11.126.0.58 and higher 11.124.0.37 and higher 11.118.0.66 and higher 11.110.0.116 and higher 11.110.0.117 and higher 11.102.0.41 and higher 11.94.0.30 and higher 11.86.0.43 and higher WP Squared - cPanel has released 110.0.114 as a direct update for customers who are still on CentOS 6 or CloudLinux 6. Users are advised to update to the latest versions for optimal protection."

"While there is no evidence that the vulnerabilities have been exploited in the wild, the disclosure comes days after another critical flaw in the product (CVE-2026-41940) has been weaponized by threat actors as a zero-day to deliver Mirai botnet variants and a ransomware strain called Sorry."

cPanel and Web Host Manager released updates to address three vulnerabilities that could be exploited for privilege escalation, code execution, and denial-of-service. CVE-2026-29201 involves insufficient input validation of a feature file name in an adminbin call, enabling arbitrary file read. CVE-2026-29202 involves insufficient input validation of a plugin parameter in the create_user API call, enabling arbitrary Perl code execution under the authenticated account’s system user. CVE-2026-29203 involves unsafe symlink handling that allows modification of access permissions of an arbitrary file using chmod, potentially causing denial-of-service or privilege escalation. Fixed versions are listed for cPanel and WHM, and WP Squared 110.0.114 is provided for CentOS 6 or CloudLinux 6. No exploitation evidence is reported, but the timing follows a weaponized zero-day, CVE-2026-41940, linked to Mirai variants and ransomware.

Read at The Hacker News