CVE-2026-32992

Published: May 13, 2026Modified: Aug 12, 2026

8.2

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Exploitability: 3.9 / Impact: 4.2

Source: support@hackerone.com (Secondary)

Description

SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle the request and capture credentials.

Affected (11)

Products: Cpanel: Cpanel, Wp Squared, Whm

3 products

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Cpanel Cpanel	126.0.0 ≤ version < 126.0.59
Cpanel Cpanel	130.0.0 ≤ version < 130.0.23
Cpanel Cpanel	132.0.0 ≤ version < 132.0.32
Cpanel Cpanel	134.0.0 ≤ version < 134.0.26
Cpanel Cpanel	136.0.0 ≤ version < 136.0.10
Cpanel Wp Squared	126.1.0 ≤ version < 136.1.12

Configuration B

5 vulnerable

Vulnerable Software	Affected Versions
Cpanel Whm	126.0.0 ≤ version < 126.0.59
Cpanel Whm	130.0.0 ≤ version < 130.0.23
Cpanel Whm	132.0.0 ≤ version < 132.0.32
Cpanel Whm	134.0.0 ≤ version < 134.0.26
Cpanel Whm	136.0.0 ≤ version < 136.0.10

Related CWEs

CWE-295

Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

References (1)

https://support.cpanel.net/hc/en-us/articles/40437241987607-Security-CVE-2026-32992-cPanel-WHM-WP2-Security-Update-May-13-2026

Source: support@hackerone.com

Vendor Advisory

Timeline

No history available yet.