cPanel and WHM Patch Three Flaws Enabling Code Execution and Possible Privilege Escalation
Summary
cPanel and WHM patched three flaws enabling arbitrary file read, authenticated Perl code execution, and denial-of-service or possible privilege escalation. The article reports no evidence these flaws were exploited and lists fixed releases, including 110.0.114 for older
Key points
- CVE-2026-29201 could allow arbitrary file reads through insufficient input validation.
- CVE-2026-29202 could permit arbitrary Perl code execution as an authenticated account's system user.
- CVE-2026-29203 involves unsafe symlink handling that could cause denial-of-service or possible privilege escalation.
- Fixes are available across multiple cPanel and WHM releases; version 110.0.114 is available for customers on CentOS 6 or CloudLinux 6.
- The article says there is no evidence the three newly addressed vulnerabilities were exploited in the wild.
- Separately, it reports that CVE-2026-41940 was weaponized to deliver Mirai variants and the Sorry ransomware strain.
Article Details
- Vulnerability Types
- Insufficient input validation permitting arbitrary file read
- Insufficient input validation permitting arbitrary Perl code execution
- Unsafe symlink handling permitting arbitrary-file permission changes, denial-of-service, or possible privilege escalation
- Severity
- CVSS 4.3 for CVE-2026-29201; CVSS 8.8 for CVE-2026-29202 and CVE-2026-29203
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
CVE
CVE-2026-29201WebPros · cPanel; WebPros · cPanel (CloudLinux 6, CentOS 6); +1 more#cPanelCVE-2026-29202WebPros · cPanel; WebPros · cPanel (CloudLinux 6, CentOS 6); +1 more#cPanelCVE-2026-29203WebPros · cPanel; WebPros · cPanel (CloudLinux 6, CentOS 6); +1 more#cPanelCVE-2026-41940WebPros · cPanel; WebPros · WHM; +1 moreand users on older CentOS 6 or CloudLinux 6 systems should update to 110.0.114 while noting that CVE-2026-41940 was recently weaponized to deploy Mirai and Sorry.
Malware
Vendors
Products
cPanelcPanel has released updates for three vulnerabilities in cPanel and WHM that could lead to arbitrary file read, Perl code execution, denial-of-service, and possible privilege escalation.WHMcPanel has released updates for three vulnerabilities in cPanel and WHM that could lead to arbitrary file read, Perl code execution, denial-of-service, and possible privilege escalation.