Overview
cPanel has announced a security update for cPanel & WHM, addressing multiple security vulnerabilities affecting cPanel & WHM version 120 and later.
The vulnerabilities include issues rated up to Critical severity. At the time of this advisory, cPanel has stated that there are no known public exploits or proof-of-concept (PoC) code available for the reported vulnerabilities.
Technical details, affected components, and the exact patched versions are expected to be published by cPanel alongside the security release.
Security recommendation: Administrators running affected versions should review their update configuration and ensure that systems are prepared to receive the security update promptly.
Affected Versions
The security update applies to:
- cPanel & WHM version 120 and later
Administrators should identify all servers running affected versions and verify that they are configured to receive cPanel security updates automatically.
What you should do
1. Identify Affected Servers
Review your infrastructure and identify all servers running cPanel & WHM version 120 or later.
For environments with multiple cPanel servers, maintain an inventory of the affected systems so that the security update can be tracked across the infrastructure.
You can see the version at the top of WHM, or run:
/usr/local/cpanel/cpanel -V2. Verify Automatic Update Configuration
Administrators should verify that automatic updates are enabled on affected cPanel servers.
The update configuration can be reviewed in:
/etc/cpupdate.confPay particular attention to servers where:
- Automatic updates are disabled
- cPanel updates have been manually restricted
- The cPanel version has been pinned
- Updates require manual approval or maintenance windows
Ensuring that the update mechanism is properly configured will help the security patch reach affected systems as soon as it becomes available.
3. Plan for Maintenance
Organizations that require maintenance windows for control-panel updates should coordinate with their infrastructure, operations, and security teams in advance.
Before applying the update, consider:
- Reviewing backup status
- Confirming application availability requirements
- Identifying customer-impacting services
- Planning an appropriate maintenance window
- Establishing rollback or recovery procedures where applicable
4. Perform a Manual Update
Once the security update is officially available, administrators can manually initiate the cPanel update using:
/scripts/upcpBefore manually initiating the update, ensure that the server's backup and maintenance procedures have been completed according to your organization's operational requirements.
After the update, administrators should verify the installed cPanel & WHM version and confirm that critical services are functioning normally.
Post-Update Verification
Following the security update, administrators should verify:
- The cPanel & WHM version has been updated to the appropriate patched release.
- cPanel-related services are running normally.
- Websites and hosted applications remain accessible.
- Email services are functioning correctly.
- DNS and other hosting services are operating as expected.
- No unexpected errors are reported in relevant system and cPanel logs.
For environments with centralized monitoring, administrators should also review monitoring dashboards and alerts following the update.
Important Note
Organizations running cPanel & WHM version 120 or later should review their update configuration and identify systems that may be affected by the September 2026 security release.
Given that the vulnerabilities include issues rated up to Critical severity, administrators should apply the official security update as soon as their organization's backup, change-management, and maintenance procedures allow.
Security teams should continue monitoring cPanel's official security communications for the final advisory, patched versions, vulnerability identifiers, and recommended remediation steps.
