# cPanel Patches Critical Privilege Escalation and Code Execution Flaws Ahead of Active Exploitation Campaign
## The Threat
cPanel, one of the most widely deployed hosting control panels globally, has released security updates addressing three new vulnerabilities that could allow attackers to achieve arbitrary code execution, privilege escalation, and denial-of-service conditions. The timing is critical: these patches arrive just days after a separate cPanel vulnerability (CVE-2026-41940) was weaponized in the wild to distribute Mirai botnet variants and the Sorry ransomware strain.
The vulnerabilities span different attack vectors. CVE-2026-29202 and CVE-2026-29203 are rated as high-severity with CVSS scores of 8.8, indicating they pose significant risk to unpatched systems. CVE-2026-29202 enables arbitrary Perl code execution through insufficient input validation in the create_user API, allowing authenticated users to execute malicious code on behalf of their system account. CVE-2026-29203 involves unsafe symlink handling that could permit attackers to modify file permissions, potentially leading to either denial-of-service or privilege escalation depending on the target files.
For hosting providers and server administrators, these vulnerabilities represent an immediate and material risk. cPanel and WHM (Web Host Manager) are the administrative interfaces for millions of web servers globally, making them high-value targets for both opportunistic attackers and sophisticated threat actors. The convergence of active exploitation of a related flaw and the disclosure of these three new vulnerabilities creates a dangerous window where defenders must act quickly.
## Severity and Impact
| Field | Details |
|-------|---------|
| CVE-2026-29201 | Insufficient input validation in feature file name (LOADFEATUREFILE adminbin call) |
| CVSS Score | 4.3 (Medium) |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | Low |
| User Interaction | None |
| Scope | Changed |
| Impact | Arbitrary file read |
| --- | --- |
| CVE-2026-29202 | Insufficient input validation in plugin parameter (create_user API call) |
| CVSS Score | 8.8 (High) |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | Low |
| User Interaction | None |
| Scope | Unchanged |
| Impact | Arbitrary Perl code execution as authenticated account's system user |
| --- | --- |
| CVE-2026-29203 | Unsafe symlink handling vulnerability |
| CVSS Score | 8.8 (High) |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | Low |
| User Interaction | None |
| Scope | Unchanged |
| Impact | Arbitrary file permission modification; denial-of-service or privilege escalation |
## Affected Products
cPanel and WHM — Update to these minimum versions or later:
WP Squared — Update to 11.136.1.10 and higher
Legacy CentOS 6 / CloudLinux 6 deployments — cPanel 110.0.114 is available as a direct update path for customers remaining on these older platforms.
## Mitigations
Immediate actions:
1. Prioritize patches — Apply cPanel and WHM updates immediately if your system runs an affected version. Given the context of active exploitation of CVE-2026-41940, treat this as critical infrastructure maintenance.
2. Verify your version — Log into WHM, navigate to Home > Server Status, and verify your current cPanel/WHM version. Cross-reference against the affected versions list above.
3. Deploy during low-traffic windows — Schedule updates outside business hours if possible. While cPanel updates can be applied with minimal downtime, account for potential service restarts.
4. Test in staging first — If you operate a large hosting infrastructure, deploy to a staging environment to validate that the updates do not cause compatibility issues with custom scripts or third-party integrations.
Network-level defenses:
5. Restrict API access — Limit access to the create_user API and other sensitive adminbin calls to trusted administrative networks only. Use firewall rules to deny external direct access to WHM ports.
6. Monitor account activity — Audit cPanel user accounts for unusual API calls, especially those targeting the create_user endpoint. Unusual Perl execution patterns in system logs should trigger investigation.
7. Disable legacy features — If your deployment does not require older feature file mechanisms, consider disabling LOADFEATUREFILE functionality through cPanel configuration.
8. Review user permissions — Audit existing cPanel reseller and user accounts. Remove elevated privileges for accounts that do not require them, limiting the blast radius of CVE-2026-29202 exploitation.
Detection and response:
9. Monitor logs for exploitation attempts — Search cPanel logs (typically in /var/log/) for patterns consistent with the three CVEs: unusual feature file references, plugin parameter injection, or symlink-related operations.
10. Incident response plan — If you identify signs of exploitation (unauthorized file permission changes, unexpected Perl execution, unauthorized code creation), isolate affected accounts immediately and preserve logs for forensic analysis.
## References
---
## HackWire Analysis
The pattern here is unmistakable and troubling: cPanel is under sustained attack pressure. The weaponization of CVE-2026-41940 just days before the disclosure of these three new flaws suggests attackers are actively hunting for cPanel vulnerabilities as a primary vector for mass compromise. In a shared hosting environment, a single compromised cPanel instance can cascade into dozens of compromised customer accounts.
What's particularly concerning is CVE-2026-29202's reliance on *authenticated* access. This means reseller accounts, developer accounts, and even customer accounts with elevated privileges become potential pivot points. An attacker who gains credentials to any account with create_user permissions can execute arbitrary Perl—giving them full system-level access. This is not a theoretical risk in the context of credential reuse, phishing campaigns targeting hosting providers, or lateral movement from a compromised website.
The unsafe symlink handling (CVE-2026-29203) is equally dangerous in shared hosting because it operates at the filesystem level. An attacker who can modify arbitrary file permissions doesn't just compromise their own account; they can destabilize the entire server by changing permissions on system binaries, web server config files, or other tenants' critical files.
What defenders should recognize: the *combination* of these three flaws, plus the recent active exploitation campaign, makes the next 48-72 hours a critical patching window. After that window, expect automated scanning for unpatched instances and exploitation by both commodity botnets (Mirai, DDoS for hire) and more targeted ransomware groups. If you operate cPanel infrastructure, this is not a "patch Tuesday" item—this is "patch today" territory.
— HackWire Editorial
---
## Related Coverage