Back to Security Advisories

Security Advisory: Imunify360 Quarantine Bypass via Symlink

A symlink-based bypass of Imunify360's malware quarantine is fixed in this security release: a payload that the scanner had quarantined could remain reachable through a symbolic link instead of being fully neutralized. Update Imunify360 on every server — this flaw class matters most on shared hosting, where one account's malware endangers its neighbours.

Medium
Imunify360 AlmaLinux 8 AlmaLinux 9 CentOS 7 CloudLinux 8 CloudLinux 9 Ubuntu 20.04 Ubuntu 22.04

Affected Versions

Imunify360 6.12 and earlier

Patched Version

Imunify360 6.13

Default Update CMD

yum update -y

Fix Commands

AlmaLinux 9 / CloudLinux 9

yum update imunify360-antivirus
/usr/share/immuni360/imunify360-update

AlmaLinux 8 / CloudLinux 8

yum update imunify360-antivirus
/usr/share/immuni360/imunify360-update

CentOS 7 / CloudLinux 7

yum update imunify360-antivirus
/usr/share/immuni360/imunify360-update

Ubuntu 22.04

apt update
apt upgrade imunify360-antivirus

Ubuntu 20.04

apt update
apt upgrade imunify360-antivirus

What this means under a SharedLicense license

Your SharedLicense license itself is not affected — this is a change in Imunify360 software, not in licensing. Update the product through its standard update channel. Licenses keep working through updates; nothing needs re-issuing or re-activating.

What happened

Imunify360, the malware-scanning and quarantine suite used across cPanel & WHM, DirectAdmin and Plesk servers, could be bypassed through symlinked paths: a file flagged and moved to quarantine remained reachable when a symbolic link pointed back to its original location. The scanner’s verdict was correct — the enforcement was not.

Who is affected

Servers running Imunify360, above all shared-hosting platforms where untrusted user uploads are the norm. The bypass undermines automated remediation: an operator may believe a payload was neutralized while it still resolves inside the account.

How to apply the fix

  • Update the package: yum update imunify360
  • Restart the Imunify360 service so the new build is loaded.
  • Re-scan accounts that received malware verdicts during the exposed window and confirm quarantined files no longer resolve.

For SharedLicense customers

Your license itself is not affected — this is a change in Imunify360 software, not in licensing. Licenses keep working through the update; only the security posture of the server changes, for the better.

Frequently Asked Questions

What is the Imunify360 quarantine bypass?
A flaw that let quarantined malware stay reachable through symlinked paths instead of being fully neutralized.
Is my SharedLicense license affected?
No — the flaw is in Imunify360 software, not in licensing. Licenses continue to work normally through the update.
How do I update Imunify360?
Run yum update imunify360 on the server, restart the service, and re-scan accounts with recent malware verdicts.

References

Security Advisories

Related Advisories

Linux Kernel (FIPS) Vulnerabilities — Ubuntu Security Update (USN-9027-2)

2026-11-13

Linux Kernel (NVIDIA Tegra) Vulnerabilities — Ubuntu Security Update (USN-9091-1)

2026-11-13

Linux Kernel (HWE) Vulnerabilities — Ubuntu Security Update (USN-9018-2)

2026-11-12

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System