High 8.2Published May 13, 2026

CVE-2026-32992SSL verification is disabled in the DNS Cluster system.

Updated under an hour ago (Oct 27, 2026, 4:30 PM ET)

Does this affect you?

It affects WebPros cPanel and 4 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for WebPros cPanel

Exploited in the last 30 days

SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle the request and capture credentials.

CVSS: 8.2 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Weakness (CWE): CWE-295
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: hackerone
NVD analysis: Analyzed
Record last updated: May 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

WebPros cPanel webpros:cpanel (from the name)	from 11.136.0.0 before 11.136.0.10; from 11.134.0.0 before 11.134.0.26; from 11.132.0.0 before 11.132.0.32; from 11.130.0.0 before 11.130.0.23; from 11.126.0.0 before 11.126.0.59	CNA record
WebPros WP Squared webpros:wp_squared (from the name)	from 11.126.1.0 before 11.136.1.12	CNA record
cpanel cpanel cpanel:cpanel	from 126.0.0 before 126.0.59; from 130.0.0 before 130.0.23; from 132.0.0 before 132.0.32; from 134.0.0 before 134.0.26; from 136.0.0 before 136.0.10	NVD
cpanel wp_squared cpanel:wp_squared	from 126.1.0 before 136.1.12	NVD
cpanel whm cpanel:whm	from 126.0.0 before 126.0.59; from 130.0.0 before 130.0.23; from 132.0.0 before 132.0.32; from 134.0.0 before 134.0.26; from 136.0.0 before 136.0.10	NVD

References

References

https://support.cpanel.net/hc/en-us/articles/40437241987607-Security-CVE-2026-32992-cPanel-WHM-WP2-Security-Update-May-13-2026	vendor-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.