cPanel cPanel/WHM Multiple Vulnerabilities

CERT-Bund has released a security advisory (WID-SEC-2026-0835) detailing multiple critical vulnerabilities in cPanel cPanel/WHM, rated with a CVSS base score of 9.8. The vulnerabilities, affecting Linux and UNIX operating systems, allow remote, anonymous attackers to bypass security measures, conduct XSS and SSRF attacks, disclose information, and potentially execute code. Affected versions include cPanel cPanel/WHM prior to 126.0.49 and prior to 134.0.12.

Organizations using cPanel cPanel/WHM should immediately review their versions and apply available mitigations or update to patched versions to prevent exploitation. The advisory indicates that remote attacks are possible and highlights the critical nature of these security flaws, necessitating prompt attention to avoid potential system compromise and data breaches.