CVE-2026-32992

Published: May 13, 2026Modified: Aug 12, 2026

8.2

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Exploitability: 3.9 / Impact: 4.2

Source: support@hackerone.com (Secondary)

Description

SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle the request and capture credentials.

Affected (11)

Products: Cpanel: Cpanel, Wp Squared, Whm

3 products

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Cpanel Cpanel	From 126.0.0 to 126.0.59
Cpanel Cpanel	From 130.0.0 to 130.0.23
Cpanel Cpanel	From 132.0.0 to 132.0.32
Cpanel Cpanel	From 134.0.0 to 134.0.26
Cpanel Cpanel	From 136.0.0 to 136.0.10
Cpanel Wp Squared	From 126.1.0 to 136.1.12

Configuration B

5 vulnerable

Vulnerable Software	Affected Versions
Cpanel Whm	From 126.0.0 to 126.0.59
Cpanel Whm	From 130.0.0 to 130.0.23
Cpanel Whm	From 132.0.0 to 132.0.32
Cpanel Whm	From 134.0.0 to 134.0.26
Cpanel Whm	From 136.0.0 to 136.0.10

Related CWEs

CWE-295

Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

References (1)

https://support.cpanel.net/hc/en-us/articles/40437241987607-Security-CVE-2026-32992-cPanel-WHM-WP2-Security-Update-May-13-2026

Source: support@hackerone.com

Vendor Advisory

Timeline

No history available yet.