What is the CVSS score of CVE-2026-29206?

CVE-2026-29206 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.0%.

Cpanel CVE-2026-29206

Q: Which versions of Cpanel are affected by CVE-2026-29206?

cPanel/WHM, the widely deployed hosting control panel, contains a critical SQL injection vulnerability (CVE-2026-29206) that permits arbitrary database queries with MySQL root privileges when Slow…. A patch is available.

Q: How to fix or mitigate CVE-2026-29206?

Within 24 hours: inventory all cPanel/WHM deployments and identify which have Slow Query logging enabled (prioritize highest-risk systems first). Within 7 days: apply vendor-released patch to all affected cPanel versions (11.86-11.136) and WP Squared installations, validating in non-production environments before production deployment. Within 30 days: disable or restrict Slow Query logging where operationally unnecessary, and audit all patched systems to confirm remediation.

EUVD-2026-30203 HIGH

SQL Injection (CWE-89)

2026-05-13 hackerone

GHSA-7pf6-43fc-mx36

SQLi Cpanel Wp Squared Cpanel Cloudlinux 6 Centos 6 Webpros

8.1

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness

CWE

CWE-89

OWASP Top 10:2025

A05:2025 - Injection

ASVS 5.0

V1 - Encoding and Sanitization Parameterized queries, prepared statements

MITRE ATT&CK

2 techniques across 2 tactics: Initial Access, Persistence

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 08, 2026

SQL injection in the cPanel/WHM sqloptimizer utility script allows attackers to execute arbitrary SQL queries as the MySQL root user when Slow Query logging is enabled. The flaw affects multiple cPanel branches (11.86 through 11.136), WP Squared, and the CloudLinux 6/CentOS 6 builds, with no public exploit identified at time of analysis. EPSS is low (0.03%) and SSVC marks exploitation as 'none', but technical impact is rated total because the injection runs with full database privileges.

Affected VersionsENISA

cPanel 11.136.0.0 <11.136.0.10

cPanel 11.124.0.0 <11.124.0.38

cPanel (CloudLinux 6, CentOS 6) 11.110.0.0 <11.110.0.118

cPanel 11.130.0.0 <11.130.0.23

cPanel 11.30.0.0 <11.86.0.44

WP Squared 11.136.1.0 <11.136.1.12

cPanel 11.134.0.0 <11.134.0.26

cPanel 11.102.0.0 <11.102.0.42

cPanel 11.126.0.0 <11.126.0.59

cPanel 11.132.0.0 <11.132.0.32

cPanel 11.94.0.0 <11.94.0.31

cPanel 11.110.0.0 <11.110.0.119

cPanel 11.118.0.0 <11.118.0.67

Affected Packages

euvd cpanel fix: 11.86.0.44, 11.94.0.31, 11.102.0.42, 11.110.0.119, 11.118.0.67, 11.124.0.38, 11.126.0.59, 11.130.0.23, 11.132.0.32, 11.134.0.26, 11.136.0.10

euvd cpanel_cloudlinux_6_centos_6 fix: 11.110.0.118

euvd wp_squared fix: 11.136.1.12

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when Cpanel gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

May 14, 2026 - 02:01 EUVD

CVE Published

May 13, 2026 - 22:07 nvd

HIGH 8.1

DescriptionCVE.org

Insufficient sanitization of SQL queries in the sqloptimizer utility script allows SQL Injections on behalf of the root user if Slow Query logging is enabled.

Executive ViewAI

Why It Matters

cPanel/WHM, the widely deployed hosting control panel, contains a critical SQL injection vulnerability (CVE-2026-29206) that permits arbitrary database queries with MySQL root privileges when Slow Query logging is enabled. Although no public exploit has been identified at the time of analysis, affected organizations face direct exposure to complete data compromise and system manipulation. The combination of broad cPanel adoption, high severity (CVSS 8.1), and total technical impact makes immediate patching essential despite currently low exploitation probability.

Recommended Action

Within 24 hours: inventory all cPanel/WHM deployments and identify which have Slow Query logging enabled (prioritize highest-risk systems first). Within 7 days: apply vendor-released patch to all affected cPanel versions (11.86-11.136) and WP Squared installations, validating in non-production environments before production deployment. Within 30 days: disable or restrict Slow Query logging where operationally unnecessary, and audit all patched systems to confirm remediation.

Business Impact: High

Compensating Controls

Apply vendor patch. Interim mitigation: disable Slow Query logging on affected cPanel installations until patching is complete, as this feature must be enabled for the vulnerability to be exploited.

Threat Intelligence Overview

EPSS Score

0.0%

Top 92% exploitable

Social Media

Sightings

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +40

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

SQL Injection HIGH

SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.

More in Cpanel

View all

CVE-2026-67401 CRITICAL Act Now POC

9.9 Sep 09

Root-level remote code execution in WebPros cPanel is achievable by any mail-enabled account through a SQL injection fla

CVE-2023-29489 MEDIUM This Month POC

6.1 Apr 27

An issue was discovered in cPanel before 11.109.9999.116. Rated medium severity (CVSS 6.1), this vulnerability is remote

CVE-2018-16236 MEDIUM This Month POC

6.1 Aug 30

cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is

CVE-2026-93698 CRITICAL Act Now

9.9 Oct 02

OS command injection in cPanel and WP Squared allows an authenticated, low-privileged hosting account holder to execute

CVE-2020-26108 CRITICAL Act Now

9.8 Sep 25

cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488). Rated critical severit

CVE-2020-26105 CRITICAL Act Now

9.8 Sep 25

In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554). Rated critical severit

CVE-2020-26101 CRITICAL Act Now

9.8 Sep 25

In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549). Rated critical severit

CVE-2020-26100 CRITICAL Act Now

9.8 Sep 25

chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497). Rated critical severity (CVSS 9.8), this vulnerability

CVE-2020-26098 CRITICAL Act Now

9.8 Sep 25

cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution (SEC-485). Rated critical severit

CVE-2020-10121 CRITICAL Act Now

9.8 Mar 17

cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs (SEC-546). Rated critical s

CVE-2020-10119 CRITICAL Act Now

9.8 Mar 17

cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell (SEC-544). Rated c

CVE-2026-87900 CRITICAL Act Now

9.4 Sep 23

Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows a remote authenticated (low-privileged, PR:L

Same weakness CWE-89 – SQL Injection

View all

CVE-2023-48788 CRITICAL POC

9.8

CVE-2019-7481 HIGH POC

7.5

CVE-2025-57819 CRITICAL POC

10.0

CVE-2017-8917 CRITICAL POC

9.8

CVE-2024-27956 CRITICAL POC

9.9

CVE-2014-3704 HIGH POC

7.5

CVE-2016-2555 CRITICAL POC

9.8

CVE-2016-8582 CRITICAL POC

9.8

Same technique SQLi

View all

CVE-2013-0333 HIGH POC

7.5

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-29206 ADVISORY https://vuldb.com/vuln/363759 REF https://support.cpanel.net/hc/en-us/articles/40437213099159-Security-CVE-2026-29206-cPanel-WHM-WP2-Security-Update-May-13-2026

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back