Quick answers
- Is CVE-2026-32992 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-32992 being exploited in the wild.
- How severe is CVE-2026-32992?
- High severity, with a CVSS score of 8.2, published 13 May 2026.
- Which products and versions are affected?
- cPanel cPanel & WHM.
- Is there a fix for CVE-2026-32992?
- A patch was published on 2026-05-13. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-32992 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-32992?
- Check whether you run cPanel WP Squared. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The cPanel DNS Cluster system suffers from improper certificate validation (CWE-295) because SSL verification is explicitly disabled during communication. This vulnerability allows a network-positioned attacker to perform a man-in-the-middle (MitM) attack without requiring any prior authentication or user interaction. By intercepting the unverified connection, the attacker can capture sensitive credentials transmitted between cluster nodes. The issue was addressed in the May 13, 2026, security update for cPanel & WHM.
Affected products
- cPanel cPanel & WHM
Timeline
- 2026-05-13: disclosed
- 2026-05-13: patched
- 2026-05-13: advisory