⚠️ Critical cPanel Security Vulnerability
A security issue identified as CVE-2026-32992 affects the DNS Cluster system in cPanel & WHM versions 126 and later.
🔍 Vulnerability Overview
cPanel discovered that SSL verification inside the DNS Cluster system was not fully enforced.
Due to incomplete SSL validation, a malicious server could potentially perform a Man-in-the-Middle (MITM) attack and intercept sensitive credentials exchanged between clustered DNS servers.
This vulnerability impacts environments using DNS clustering across multiple cPanel/WHM servers.
🚨 Potential Impact
- DNS Cluster credential interception
- Man-in-the-Middle (MITM) attacks
- Unauthorized DNS cluster access
- Potential DNS zone manipulation
- Cluster trust compromise
📌 Affected Versions
This vulnerability affects:
✅ Patched cPanel Versions
11.136.1.12 and higher
🛠️ How to Update cPanel
Run the following command as root:
After updating, verify the installed version:
🔒 Additional Security Fixes Included
The latest release also resolves:
🔒 Security Recommendation
If your infrastructure uses DNS Clustering between multiple cPanel servers, update immediately and verify secure communication between all cluster nodes.
Outdated cPanel servers using DNS Clustering may remain vulnerable to credential interception and Man-in-the-Middle attacks until updated to a patched release.