Security: CVE-2026-32992 – cPanel & WHM / WP2 Security Update – May 13, 2026

It was found that SSL verification was not fully enforced in the DNS Cluster system, which could allow for a malicious server to man-in-the-middle the request and capture credentials. This affects cPanel & WHM versions 126 and higher.

High 8.2 CVSS 2026-09-08

cPanel

डिफ़ॉल्ट अपडेट कमांड

sudo /scripts/upcp --force

SharedLicense लाइसेंस के तहत इसका अर्थ

Your SharedLicense license itself is not affected — this is a vulnerability in cPanel software, not in licensing. Licenses continue to work during and after the update; there is no need to re-issue or re-activate anything. If you resell cPanel under your own brand, patch client servers too — unpatched installs put your reputation at risk, not your license.

Situation

Impact

We have pushed out a patch in the following cPanel & WHM versions:

11.126.0.59 and higher
11.130.0.23 and higher
11.132.0.32 and higher
11.134.0.26 and higher
11.136.0.10 and higher

We have pushed out a patch in the following WP Squared version:

11.136.1.12 and higher

Note: All further versions of cPanel are patched for this issue as well. Please see the latest changelogs for version information of each cPanel branch:
https://docs.cpanel.net/changelogs/

Call to Action

Update the cPanel version on the server to one of the versions listed above. This can be done with the following:

# /scripts/upcp –force
Once completed, verify the cPanel version with the following to ensure the update was successful.

# /usr/local/cpanel/cpanel -V

Additional Information

Additional security incidents are resolved in this latest release as well. Please see the following for more information:

अक्सर पूछे जाने वाले प्रश्न

What is CVE-2026-32992?

It is the vulnerability ID assigned to this cPanel security issue. See the references below for the authoritative record.

Is CVE-2026-32992 being exploited in the wild?

No confirmed exploitation is recorded. The EPSS model estimates a 0.25% probability of exploitation within the next 30 days — patch on your normal schedule.

How do I fix CVE-2026-32992?

Update cPanel to the patched release.Then confirm the running version matches the patched release listed above.

Why does this advisory list several CVEs?

One vendor release fixed multiple vulnerabilities. This advisory covers CVE-2026-32992, CVE-2026-29205, CVE-2026-29206, CVE-2026-32991, CVE-2026-32993 — updating to the patched release resolves all of them at once.

संदर्भ

सुरक्षा सलाह

अपने सिस्टम में भेद्यताओं की जाँच करें

अपना उत्पाद और ऑपरेटिंग सिस्टम चुनें ताकि आपके लिए लागू सटीक फिक्स कमांड देख सकें।

अपना सिस्टम जाँचें