cPanel’s DNS Cluster feature is used to link multiple cPanel servers together and sync DNS records automatically. The conversation between them goes over HTTPS as API calls, which means the traffic carries access hashes and tokens.
This is exactly where the core of CVE-2026-32992 begins. The DNS Cluster module sets up a TLS connection, but it never verifies the other side’s certificate. A fake certificate? Accepted. Expired? Accepted. A different CN? Accepted. There’s SSL, sure, but the verification side is completely off.
The CVSS score is 8.2. There’s a high confidentiality impact because the credentials in cluster-to-cluster communication get exposed. CWE-295, classic improper certificate validation.
Conceptually, the attack scenario goes like this: If the attacker can get onto any point of the path between two servers in the cluster (same VLAN inside the data center, BGP hijack, a malicious hosting neighbor, whatever it is), they step in between. They present a fake certificate they generated themselves. Since the DNS Cluster module doesn’t verify, the connection gets established. Once the connection is up, the API calls passing through it flow in cleartext on the attacker’s side. The cluster auth information is exposed.
The really dangerous part starts afterwards. With that auth information, the attacker gains DNS write access to any server in the cluster. They can point MX to their own server, move the A record to another IP, relocate NS somewhere else entirely. Mail interception, phishing, subdomain takeover, it all opens up.
The affected versions are as follows:
cPanel:
11.136.0.0 to before 11.136.0.10
11.134.0.0 to before 11.134.0.26
11.132.0.0 to before 11.132.0.32
11.130.0.0 to before 11.130.0.23
11.126.0.0 to before 11.126.0.59
WP Squared:
11.126.1.0 to before 11.136.1.12You can check the version in the WHM panel under “Server Configuration > Server Status” or over SSH.
/usr/local/cpanel/cpanel -VIf the output shows a version below the ranges above, don’t delay the update. cPanel released the patch on May 13, 2026; you can pull it with upcp -force or through an upgrade from the panel. No extra configuration change is needed; the patch turns SSL verification on by default directly.
If you couldn’t apply the patch, there’s one more control. Making sure the servers in the cluster talk only over a trusted internal network, and not routing this traffic over the WAN, provides a temporary safeguard. But this isn’t a permanent fix, and it’s not an excuse to skip the patch either. A classic CWE-295 case, and the fix is clear too.
Sources
https://nvd.nist.gov/vuln/detail/CVE-2026-32992
https://support.cpanel.net/hc/en-us/articles/40437241987607-Security-CVE-2026-32992-cPanel-WHM-WP2-Security-Update-May-13-2026