CVE-2026-32992

Severity: high (CVSS 8.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-13 · updated 2026-10-26
Weakness: CWE-295

Description

SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle the request and capture credentials.

Affected products

WebPros cPanel: from 126.0.0 before 126.0.59; from 130.0.0 before 130.0.23; from 132.0.0 before 132.0.32; from 134.0.0 before 134.0.26; from 136.0.0 before 136.0.10 — fixed in 126.0.59, 130.0.23, 132.0.32, 134.0.26, 136.0.10
WebPros WHM: from 126.0.0 before 126.0.59; from 130.0.0 before 130.0.23; from 132.0.0 before 132.0.32; from 134.0.0 before 134.0.26; from 136.0.0 before 136.0.10 — fixed in 126.0.59, 130.0.23, 132.0.32, 134.0.26, 136.0.10
WebPros WP Squared: from 126.1.0 before 136.1.12 — fixed in 136.1.12

How to fix

Upgrade to a fixed version: WebPros cPanel 126.0.59, 130.0.23, 132.0.32, 134.0.26; WebPros WHM 126.0.59, 130.0.23, 132.0.32, 134.0.26; WebPros WP Squared 136.1.12. Check the vendor advisory for mitigations.

References

https://support.cpanel.net/hc/en-us/articles/40437241987607-Security-CVE-2026-32992-cPanel-WHM-WP2-Security-Update-May-13-2026

Get alerted when CVE-2026-32992 or the next vulnerability affects your stack