What’s Vulnerable › Vulnerabilities

CVE-2020-29136

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-11-27 · updated 2026-06-17
• Weakness: CWE-307

Description

In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach (SEC-575).

Affected products

• WebPros cPanel: before 11.86.0.32; from 11.90.0 before 11.90.0.17; from 11.92.0 before 11.92.0.2 — fixed in 11.86.0.32, 11.90.0.17, 11.92.0.2

How to fix

Upgrade to a fixed version: WebPros cPanel 11.86.0.32, 11.90.0.17, 11.92.0.2. Check the vendor advisory for mitigations.

References

• https://docs.cpanel.net/changelogs/90-change-log/
• https://news.cpanel.com/cpanel-tsr-2020-0007-full-disclosure/
• https://www.digitaldefense.com/news/zero-day-cpanel-and-webhost-manager/
• https://docs.cpanel.net/changelogs/90-change-log/
• https://news.cpanel.com/cpanel-tsr-2020-0007-full-disclosure/
• https://www.digitaldefense.com/news/zero-day-cpanel-and-webhost-manager/

Get alerted when CVE-2020-29136 or the next vulnerability affects your stack