cPanel CVE-2026-32993: HTTP Header Injection and How to Fix It

At a glance

What it is

CVE-2026-32993 is an HTTP header injection flaw. According to public reports, the status value of the endpoint /unprotected/nova_error is reflected in the response headers without cleaning. An attacker can build a special request that changes parts of the response headers. The flaw works without logging in.

Headers are more than technical data. A person who controls them may be able to change browser behavior, caching, redirects or other protections. Even if the flaw does not give full control of the server, it can help with phishing, cache poisoning, session confusion or abuse of the service.

Who is affected

Any server that runs a vulnerable build of cPanel & WHM: shared, VPS, dedicated and managed servers. Hosting providers need extra care, because one control panel serves many customers, and many sites can be hit at once. A panel open to the internet is at the highest risk.

Vulnerable and fixed versions

Risk if you do not patch

• Attackers can manipulate HTTP responses.
• Redirects, caches and browser actions can be abused.
• Trust in your hosting suffers, and in a shared setup the effect can reach many customer sites.

Check your server

In WHM, the version shows at the top right or under server information. Or connect by SSH and run:

/usr/local/cpanel/cpanel -V

Compare the result with the fixed builds in the table. The folder /var/cpanel/updatelogs/ shows whether the security update was installed.

Fix it

Update cPanel & WHM to the newest security release of your version line.

1. Use the update section in WHM and install the newest build that your update tier allows, or run the official update from SSH. Do not use third-party scripts or unofficial patches.
2. When it finishes, run /usr/local/cpanel/cpanel -V again and compare the version with the fixed build.
3. Read the update logs for errors, stopped downloads or missing dependencies. A correct version number plus a clean log shows the update worked.

If you cannot patch right away

• Allow only trusted IP addresses to reach WHM and cPanel. This is the most important step if the panel is open to the internet.
• If you use a reverse proxy or a WAF, tighten its rules for requests to the vulnerable endpoint and for unusual header values.
• Watch the logs for odd requests.

After you patch

• Check that WHM loads as it should.
• Look at the privileged accounts and settings.
• Read the access logs for signs of abuse before the update.

Harden your cPanel server

• Turn on two-factor authentication for admins.
• Limit panel access by IP address or VPN.
• Turn on automatic updates.
• Keep off-site backups and use monitoring.

Quick recap

• The flaw lets attackers inject response headers without a login.
• Update to a fixed build and check the logs.
• Limit who can reach the panel.