Critical cPanel Vulnerability Enables Remote Code Execution

CERT-Bund Security Advisories

Published March 31st, 2026

Detected April 1st, 2026

Summary

CERT-Bund issued a critical security advisory (WID-SEC-2026-0939) regarding a remote code execution vulnerability in cPanel cPanel/WHM software. The vulnerability in perl-YAML-Syck component carries a CVSS Base Score of 9.1. Affected versions include cPanel/WHM versions prior to 110.0.93, 126.0.50, and 134.0.13. A remote, unauthenticated attacker can exploit this flaw to execute arbitrary code or cause denial of service.

View original document View source feed page

What changed

CERT-Bund published security advisory WID-SEC-2026-0939 warning of a critical vulnerability in cPanel cPanel/WHM (perl-YAML-Syck) with CVSS Base Score 9.1. The flaw allows remote, unauthenticated attackers to potentially execute arbitrary code or cause denial of service. Affected products are cPanel cPanel/WHM versions below 110.0.93, 126.0.50, and 134.0.13.

Organizations running vulnerable cPanel installations on Linux or UNIX systems should immediately update to one of the patched versions (110.0.93, 126.0.50, or 134.0.13) or apply available mitigations. System administrators should prioritize patching internet-facing hosting servers as remote exploitation is possible without authentication.

What to do next

Update cPanel cPanel/WHM to version 110.0.93, 126.0.50, or 134.0.13 or later
Apply available mitigations if immediate patching is not feasible
Audit systems for indicators of compromise given remote code execution capability

Source document (simplified)

[WID-SEC-2026-0939] cPanel cPanel/WHM (perl-YAML-Syck): Schwachstelle ermöglicht Codeausführung und DoS CVSS Base Score 9.1 (kritisch) CVSS Temporal Score 7.9 (hoch) Remoteangriff ja Datum 31.03.2026 Stand 01.04.2026 Mitigation ja

Betroffene Systeme

Betriebssystem

Linux
UNIX

Produktbeschreibung

cPanel ist eine Software für die Verwaltung von Webhosting Auftritten. Die Software ermöglicht es dem Endanwender, Statistiken einzusehen, neue Benutzeraccounts anzulegen, Maileinstellungen zu verändern und vieles mehr.

Produkte

31.03.2026
- cPanel cPanel/WHM <110.0.93

cPanel cPanel/WHM <126.0.50
cPanel cPanel/WHM <134.0.13

Angriff

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in cPanel cPanel/WHM ausnutzen, um potenziell beliebigen Code auszuführen oder einen Denial-of-Service-Zustand zu verursachen. CVE Informationen Versionshistorie Feedback zum Advisory geben