cPanel WHM EUVD-2026-30180

Exploitation requires that the target operate a cPanel/WHM or WP Squared DNS Cluster (the affected feature is the DNS Cluster system specifically - standalone WHM installations without clustering are not exposed) AND that the attacker hold a man-in-the-middle position on the network path between two cluster nodes, since the bug is failure to validate the peer's TLS certificate. No authentication or user interaction is required against the vulnerable endpoint (PR:N/UI:N), and exploitation works against the default DNS Cluster configuration once clustering is enabled. Limiting factors: attacker must already be path-adjacent (BGP hijack, ARP/DNS poisoning on a shared segment, or control of upstream infrastructure), and only cluster credentials - not arbitrary WHM data - are directly disclosed; deployments that tunnel cluster traffic over a private VPN or dedicated link materially reduce realistic exposure.

The CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/I:L/A:N, score 8.2) reflects network-reachable, unauthenticated exploitation with high confidentiality impact, which aligns with stolen cluster credentials. However, EPSS is only 0.03% (7th percentile) and SSVC records Exploitation: none, meaning no observed activity. SSVC also marks the issue Automatable: yes with partial technical impact, which is consistent with MITM tooling but is offset by the practical requirement that the attacker already occupy a privileged network position between two cooperating cluster nodes. There is tension between the high CVSS score and the low EPSS/SSVC exploitation signal: the CVSS scoring assumes the MITM precondition is met, while real-world exploitation requires path-adjacent positioning that most cluster deployments do not expose to untrusted networks. No KEV listing and no public exploit reduce urgency below what the 8.2 score alone suggests, but credential theft consequences justify prompt patching for any cluster crossing untrusted links.

An attacker who has compromised an upstream router, ISP segment, or DNS resolver between two cPanel DNS Cluster peers intercepts the outbound TLS connection from the source WHM server to a peer, presents an attacker-controlled certificate that the client accepts because verification is disabled, and captures the cluster API credentials submitted in the request. With those credentials the attacker can authenticate to the legitimate peer's WHM API and read or modify DNS zone data across the cluster. No public PoC is identified at this time.