CVE-2026-32992CWE-295

CVE-2026-32992

High · published May 14, 2026

CVSS v3.1
8.2
EPSS
0%
Percentile
23.9
In the wild
Unconfirmed
What it is

SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle the request and capture credentials.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00321 · 23.9th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2026-05-14T02:16Z
Affected products (11)
ProductVersionsFixed in
cpanel/cpanel≥ 126.0.0, < 126.0.59126.0.59
cpanel/cpanel≥ 130.0.0, < 130.0.23130.0.23
cpanel/cpanel≥ 132.0.0, < 132.0.32132.0.32
cpanel/cpanel≥ 134.0.0, < 134.0.26134.0.26
cpanel/cpanel≥ 136.0.0, < 136.0.10136.0.10
cpanel/wp_squared≥ 126.1.0, < 136.1.12136.1.12
cpanel/whm≥ 126.0.0, < 126.0.59126.0.59
cpanel/whm≥ 130.0.0, < 130.0.23130.0.23
cpanel/whm≥ 132.0.0, < 132.0.32132.0.32
cpanel/whm≥ 134.0.0, < 134.0.26134.0.26
cpanel/whm≥ 136.0.0, < 136.0.10136.0.10
References (1)
https://support.cpanel.net/hc/en-us/articles/40437241987607-Security-CVE-2026-32992-cPanel-WHM-WP2-Security-Update-May-13-2026 · [email protected]
EPSS history
Timeline
  • 13 MAY 22:06Z
    SSL verification is disabled in the DNS Cluster system
    cvelistv5