cPanel has released security updates for cPanel and Web Host Manager after disclosing three newly patched vulnerabilities that could expose hosting environments to file access, code execution, denial-of-service, or possible privilege escalation risks.
The update matters because cPanel and WHM often sit at the center of shared hosting, reseller hosting, agency hosting, and managed server environments. A weakness in that layer can affect far more than one website, especially when one server hosts many customer accounts.
There is no public indication in the source disclosure that these three newly patched issues have been exploited in the wild. Even so, the timing is uncomfortable for administrators because the fixes arrive shortly after a separate critical cPanel authentication-bypass flaw, CVE-2026-41940, was reported as actively abused.
For hosting providers, agencies, and businesses that buy managed hosting, the immediate question is simple: is the server on a patched branch, and has that update actually been applied?
What cPanel Fixed
The May 2026 update covers three CVEs across cPanel and WHM, including two issues with CVSS scores of 8.8. The affected areas are not identical, but they all touch sensitive control-plane behavior inside a hosting administration platform.
| CVE | Reported Severity | Main Risk | Summary |
|---|---|---|---|
| CVE-2026-29201 | CVSS 4.3 | Arbitrary file read | Insufficient validation of a feature file name in the feature::LOADFEATUREFILE adminbin call could allow a relative path to be passed and make an arbitrary file world-readable. |
| CVE-2026-29202 | CVSS 8.8 | Perl code execution | A weakness involving the plugin parameter in the create_user API call could allow Perl code injection on behalf of an already authenticated account’s system user. |
| CVE-2026-29203 | CVSS 8.8 | Denial-of-service or possible privilege escalation | cPanel describes this as an unsafe symlink handling issue that may allow a user to run chmod against an arbitrary file, creating denial-of-service risk and possible privilege escalation. |
CVE-2026-29201 is the lowest-scored issue, but arbitrary file-read behavior can still become serious depending on what data becomes readable and which local account can trigger the path. In shared hosting, file permission boundaries are a core part of the trust model.
CVE-2026-29202 is more severe because it involves potential code execution through an API parameter. The important qualifier is that the described execution happens in the context of an already authenticated account’s system user. That does not make it harmless. It means the flaw is especially relevant where a low-privilege account can be abused to run unexpected code or where account boundaries are part of the hosting provider’s customer isolation model.
CVE-2026-29203 is also rated 8.8. The practical concern is that unsafe symlink handling can turn a normal file-permission operation into an operation against a file the user should not be able to affect. cPanel’s description frames the risk as denial-of-service and possible privilege escalation, so administrators should treat it as a server-integrity issue rather than a minor account-level bug.
Patched Versions To Check
cPanel says the issues are fixed in the following cPanel and WHM versions and later builds:
- 11.136.0.9 and higher
- 11.134.0.25 and higher
- 11.132.0.31 and higher
- 11.130.0.22 and higher
- 11.126.0.58 and higher
- 11.124.0.37 and higher
- 11.118.0.66 and higher
- 11.110.0.116 and higher
- 11.110.0.117 and higher
- 11.102.0.41 and higher
- 11.94.0.30 and higher
- 11.86.0.43 and higher
WP Squared users should check for version 11.136.1.10 or higher.
cPanel also released 110.0.114 as a direct update path for customers still running CentOS 6 or CloudLinux 6. That should not be read as a long-term comfort zone. Older operating system branches create a separate maintenance problem, and the safer route is still to move toward currently supported platforms and currently supported cPanel branches.
For administrators, the basic patch workflow is to update cPanel and then verify the installed build. The common update command is:
/scripts/upcp --force
After the update completes, the installed version can be checked with:
/usr/local/cpanel/cpanel -V
YubiKey 5 NFC Security Key
After verifying the patched cPanel build, review who can access WHM and hosting dashboards. A hardware security key can strengthen MFA for administrator accounts where supported by the login provider or identity system.
As an Amazon Associate I earn from qualifying purchases.
If a hosting provider manages the server for you, ask for the exact cPanel and WHM version after patching, not just a general statement that updates are automatic. Automatic update settings can be disabled, pinned, delayed by branch policy, or blocked by unsupported operating systems.
Why This Patch Cycle Deserves Attention
These three flaws are separate from CVE-2026-41940, the critical cPanel authentication-bypass issue disclosed shortly before them. That earlier vulnerability raised the pressure on hosting teams because it affected the login flow and was reported as being abused in real attacks.
The new May 2026 flaws do not need to be treated as the same incident. They are lower in urgency than an actively exploited authentication bypass. But they do reinforce the same operational lesson: hosting control panels are high-value infrastructure, and patch lag can quickly become customer-impacting risk.
For shared hosting companies and MSPs, cPanel is often both an internal operations tool and a customer-facing access layer. That means the blast radius can include customer sites, email accounts, databases, file managers, backup access, DNS settings, and reseller workflows. Even vulnerabilities that require authentication can be meaningful if attackers compromise one user account first and then look for ways to cross boundaries or execute code under a local system user.
For buyers, this is also a vendor-management issue. If your business relies on a managed cPanel host, you do not need to reverse-engineer the flaws. You do need to know whether the provider patches quickly, maintains supported server branches, and has a credible incident response process when control-panel vulnerabilities are disclosed.
What Administrators Should Do Now
Administrators should prioritize direct verification over assumptions. A server that appears healthy from the website front end may still be sitting on an exposed or outdated cPanel build.
- Check the installed cPanel and WHM version on every managed server.
- Update to a patched build for the server’s branch.
- Verify the version after the update completes.
- Confirm that update preferences are not pinned to an older branch.
- Review servers running legacy operating systems, especially CentOS 6 or CloudLinux 6.
- Check logs and account activity where there are signs of suspicious user behavior, unexplained file permission changes, or unexpected account creation activity.
- Document the patched version and update time for customer, audit, or insurance questions.
This is also a useful moment to review backup and recovery posture. A working backup is not a replacement for patching, but hosting control-panel incidents can become recovery events quickly when file permissions, account contents, or hosted sites are affected.
WD Elements 8TB Desktop External Hard Drive
For agencies and site owners, a local external drive can be part of a broader backup routine alongside cloud or host-level backups. Keep backup copies separate from the affected hosting account so recovery does not depend on the same control panel.
As an Amazon Associate I earn from qualifying purchases.
For agencies and site owners using managed hosting, the practical checklist is shorter: confirm that your provider has applied the patched cPanel build, ask whether your server is on a supported operating system, and make sure recent off-server backups exist for critical sites.
Bottom Line
The cPanel and WHM May 2026 security updates close three vulnerabilities, including two rated 8.8, in a platform that many hosting environments depend on every day. The disclosed issues involve arbitrary file read, Perl code injection, and unsafe symlink handling that could lead to denial-of-service or possible privilege escalation.
There is no stated evidence that these three new vulnerabilities have been exploited in the wild, but administrators should not wait for that to change. Patch the affected branches, verify the build number, and pay special attention to servers stuck on older operating systems or pinned update tracks.
For hosting customers, the best question to ask is not whether a provider is “aware” of the issue. Ask which cPanel version your server is running now.