Back to Security Advisories

Security Advisory: cPanel cpsrvd SSL Downgrade Vulnerability

A TLS downgrade weakness in cPanel's cpsrvd daemon is fixed in this security release: connections to WHM and cPanel could be negotiated down to weaker protection, exposing login sessions to interception on hostile networks. Update cPanel & WHM with upcp and keep TLS settings modern.

High
cPanel AlmaLinux 8 AlmaLinux 9 CentOS 7 CloudLinux 8 CloudLinux 9

Affected Versions

cPanel & WHM 120.0.8 and earlier

Patched Version

cPanel & WHM 120.0.12

Default Update CMD

yum update -y

Fix Commands

AlmaLinux 9 / CloudLinux 9

dnf clean metadata
/scripts/upcp --force

AlmaLinux 8 / CloudLinux 8

dnf clean metadata
/scripts/upcp --force

CentOS 7 / CloudLinux 7

yum clean all
/scripts/upcp --force

What this means under a SharedLicense license

Your SharedLicense license itself is not affected — this is a change in cPanel & WHM software, not in licensing. Apply it on every affected server: sudo /scripts/upcp --force. Licenses keep working through updates; nothing needs re-issuing or re-activating.

What happened

cpsrvd serves the WHM and cPanel interfaces over TLS. The flaw allowed a connection downgrade: an attacker positioned between the administrator and the server could influence the negotiation toward weaker TLS, weakening the protection around credentials and session cookies that cross that link.

Who is affected

Every cPanel & WHM server, since cpsrvd fronts the management UIs. The risk concentrates on administrative logins from networks the operator does not control.

How to apply the fix

  • Update the panel: sudo /scripts/upcp --force
  • Review the TLS configuration in WHM and require modern protocol versions.
  • Have administrators with old sessions log out and back in after the update.

For SharedLicense customers

Licensing is unaffected — this is a cPanel & WHM software fix delivered through the standard update channel.

Frequently Asked Questions

What is the cpsrvd TLS downgrade?
A weakness that let management-interface connections negotiate weaker TLS, risking session interception.
What should administrators do besides updating?
Enforce modern TLS protocols in WHM and sign in again to replace any older sessions.
Does this affect hosted websites?
No — the exposure is on management-interface connections, not on the hosted sites themselves.

References

Security Advisories

Related Advisories

Perl-CGI Security Update — AlmaLinux 8 (ALSA-2026:99849)

2026-11-12

.NET 8.0 Security Update — AlmaLinux 8 (ALSA-2026:99052)

2026-11-12

Grafana Security Update — AlmaLinux 8 (ALSA-2026:99030)

2026-11-12

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System