Flash Sale:75% Off Hosting + Free DomainEnds in13h47m14sView Plans
Hostvento logoHostvento
Get Started

cPanel CVE-2026-32992 Explained: DNS Cluster Certificate Check

A flaw in the cPanel DNS Cluster can expose logins to an attacker on the network. Find out who is affected and how to fix it.

SSL and Security3 min read4 steps

What is CVE-2026-32992?

CVE-2026-32992 is an information disclosure flaw in the DNS Cluster feature of cPanel and WHM. It is a certificate validation problem (CWE-295). The cluster did not check the SSL/TLS certificates of the servers it talked to. An attacker who can sit on the network path between two cluster nodes could show a fake certificate and capture logins or session data.

It belongs to the cPanel security update of 13 May 2026. Its score is CVSS 3.1: 8.2 (High).

Who is affected?

You are affected if you run cPanel and WHM with DNS Clustering turned on. This includes shared, VPS and dedicated servers. Hosting providers with many accounts are at a higher risk, because one intercepted cluster link can expose many accounts. If you do not use DNS Clustering, this CVE does not apply to you.

ProductBranchVulnerable versionsFixed version
cPanel & WHM11.126Before 11.126.0.5911.126.0.59 or higher
cPanel & WHM11.130Before 11.130.0.2311.130.0.23 or higher
cPanel & WHM11.132Before 11.132.0.3211.132.0.32 or higher
cPanel & WHM11.134Before 11.134.0.2611.134.0.26 or higher
cPanel & WHM11.136Before 11.136.0.1011.136.0.10 or higher
WP Squared11.136Before 11.136.1.1211.136.1.12 or higher

Why you should patch

If you do not update, the flaw may let an attacker steal credentials. That can lead to unauthorized access to WHM and cPanel functions, changes to DNS zones or the takeover of user accounts.

Check your version

Look at the version shown in WHM, or connect by SSH and run:

/usr/local/cpanel/cpanel -V

Check /var/cpanel/updatelogs/ to see whether a recent update with the security fix was installed.

Fix it

Install the cPanel security update. By default, it makes the DNS Cluster check SSL certificates.

  1. In WHM: open Upgrade to Latest Version (or the update interface) and install the available updates. Confirm that the update finished and restart services if asked.
  2. From the command line: run the official update script as root:
/scripts/upcp
  1. Check the version again with /usr/local/cpanel/cpanel -V, and read the update log for errors.
  2. After the update, check the cluster health and make sure certificate verification is on for the DNS Cluster connections.

If you cannot patch right away

  • Make sure certificate verification is enabled for DNS Cluster connections.
  • Use firewall rules and an IP allow list, so only trusted networks can reach the admin interface and the cluster ports.
  • Keep cluster traffic on a private network segment or inside a VPN tunnel.
  • Watch the authentication logs for strange cluster logins.

After the update

  • Confirm the patched version.
  • Check that SSL verification is enforced in the cluster settings.
  • Read the access logs for odd logins, changes to DNS zones and unknown accounts.
  • If you see signs of abuse, rotate the affected passwords and restore from good backups.

Harden your server

  • Turn on two-factor authentication for WHM and cPanel admins.
  • Allow only known IP addresses to open the admin interface.
  • Give accounts only the rights they need, and switch off services you do not use.
  • Update the system and third-party software often, and use automatic updates when you can.
  • Keep a firewall and host monitoring in place, and keep backups.
Note: Always compare with the official cPanel security advisory. It is the final source for fixed versions.

Quick recap

  • The DNS Cluster did not check certificates, so logins could be intercepted.
  • Update to a fixed build and turn on certificate checks.
  • Limit access to the admin and cluster ports.