Volver a los avisos de seguridad

Security: CVE-2026-29206 – cPanel & WHM / WP2 Security Update – May 13, 2026

It was found that, as part of the sqloptimizer script, it was possible that a created SQL query could be injected with arbitrary SQL queries. This affects all cPanel & WHM versions.

High 8.1 CVSS
CloudLinux cPanel

CMD de actualización por defecto

sudo /scripts/upcp --force

Lo que esto significa bajo una licencia de SharedLicense

Your SharedLicense license itself is not affected — this is a vulnerability in CloudLinux, cPanel software, not in licensing. Licenses continue to work during and after the update; there is no need to re-issue or re-activate anything. If you resell CloudLinux, cPanel under your own brand, patch client servers too — unpatched installs put your reputation at risk, not your license.

Situation

It was found that, as part of the sqloptimizer script, it was possible that a created SQL query could be injected with arbitrary SQL queries. This affects all cPanel & WHM versions.

Impact

We have pushed out a patch in the following cPanel & WHM versions: 

  • 11.86.0.44 and higher
  • 11.94.0.31 and higher
  • 11.102.0.42 and higher
  • 11.110.0.118 (cl6110)
  • 11.110.0.119 and higher
  • 11.118.0.67 and higher
  • 11.124.0.38 and higher
  • 11.126.0.59 and higher
  • 11.130.0.23 and higher
  • 11.132.0.32 and higher
  • 11.134.0.26 and higher
  • 11.136.0.10 and higher

We have pushed out a patch in the following WP Squared version:

  • 11.136.1.12 and higher

For customers still on CentOS 6 or CloudLinux 6, we recommend running the following command to set the upgrade tier, and then following the steps in the “Required Actions” below.

# sed -i “s/CPANEL=.*/CPANEL=cl6110/g” /etc/cpupdate.conf

Note: All further versions of cPanel are patched for this issue as well. Please see the latest changelogs for version information of each cPanel branch:
https://docs.cpanel.net/changelogs/

Call to Action

  1. Update the cPanel version on the server to one of the versions listed above. This can be done with the following:

    # /scripts/upcp –force

  2. Once completed, verify the cPanel version with the following to ensure the update was successful.

    # /usr/local/cpanel/cpanel -V

Additional Information

Additional security incidents are resolved in this latest release as well. Please see the following for more information:

Preguntas frecuentes

What is CVE-2026-29206?
Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL Injections on behalf of the root user if Slow Query logging is enabled.
Is CVE-2026-29206 being exploited in the wild?
No confirmed exploitation is recorded. The EPSS model estimates a 0.31% probability of exploitation within the next 30 days — patch on your normal schedule.
How do I fix CVE-2026-29206?
Update CloudLinux, cPanel to the patched release.Then confirm the running version matches the patched release listed above.
Why does this advisory list several CVEs?
One vendor release fixed multiple vulnerabilities. This advisory covers CVE-2026-29206, CVE-2026-29205, CVE-2026-32991, CVE-2026-32992, CVE-2026-32993 — updating to the patched release resolves all of them at once.

Referencias

Avisos de seguridad

Avisos relacionados

EasyApache 4 25.86 — cPanel & WHM Update

2026-10-01

ConfigServer Security & Firewall (CSF) 16.32-1 — cPanel & WHM Update

2026-09-30

Sitejet Builder 4.13.1-1 — cPanel & WHM Update

2026-09-30

Comprueba tu sistema en busca de vulnerabilidades

Selecciona tu producto y sistema operativo para ver los comandos de corrección exactos que se aplican a ti.

Comprueba tu sistema