CVE-2026-29206Patch

LOWCVSS 8.1 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL Injections on behalf of the root user if Slow Query logging is enabled.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

https://support.cpanel.net/hc/en-us/articles/40437213099159-Security-CVE-2026-29206-cPanel-WHM-WP2-Security-Update-May-13-2026

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
9 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 7 signals
Technical details provided in 4 signals
Disclosure: 3 classified signals
Peaked 3d ago at 4 mentions (2026-05-13); latest day: 2
9 total mentions across 4 days

Deep dive

Activity timeline9 mentions / 4d

Signal classification2 categories

Patch

666.7%

Disclosure

333.3%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-13	4	Disclosure2Patch2
2026-05-14	2	Disclosure1Patch1
2026-05-15	1	Patch1
2026-06-24	2	Patch2

Full discourse9 posts

Rıdvan Yağlı@ridvanyagli151d
Disclosure
cPanel / WHM'de yeni güvenlik açıkları duyuruldu. Henüz NVD'de görünmeyen bu açıklar için bugün TSİ 21:00 dan sonra patch çıkacak. İlgili saatten sonra /scripts/upcp --force yapmayı unutmayın. * CVE-2026-29205 * CVE-2026-29206 * CVE-2026-32991 * CVE-2026-32992 * CVE-2026-32993
Post summary
The notice alerts cPanel/WHM users to newly disclosed vulnerabilities (CVE-2026-29205, 29206, 32991‑32993), states a patch will be released after 21:00, and advises running /scripts/upcp --force to apply the fix.
10050285
1.2K followersView on X
kokumօtօ@__kokumoto149d
Patch
cPanel & WHMでまた深刻な脆弱性5件が修正。CVE-2026-29205、CVE-2026-32993、CVE-2026-32992、CVE-2026-29206、CVE-2026-32991。 https://securityonline.info/cpanel-whm-security-patches-cve-2026-29205-file-read-sql-injection/
Post summary
cPanel & WHM have released patches for five critical CVEs, including file-read/SQL injection vulnerabilities, as referenced in the linked security article.
00032886
7.6K followersView on X
Lyrie.ai@lyrie_ai109d
Patch
cPanel & WHM is releasing an emergency security patch on May 13, 2026 at 1:00 PM EST addressing five HIGH-severity vulnerabilities (CVE-2026-29205, CVE-2026-29206, CVE-2026-32991, CVE-2026-32992, CVE-2026-32993) affecting versions 86 through 136. According to the vendor,…
Post summary
Vendor announces an emergency patch for five high‑severity CVEs affecting cPanel & WHM.
1000031
295 followersView on X
Lyrie.ai@lyrie_ai109d
Patch
The Perfect Storm: cPanel & WHM May 13 Coordinated Release — Five HIGH CVEs, Zero Exploits (Yet). cPanel & WHM is releasing an emergency security patch on May 13, 2026 at 1:00 PM EST addressing five HIGH-severity vulnerabilities CVE-2026-29205, CVE-2026-29206,…
Post summary
cPanel & WHM will issue an emergency patch for five high‑severity CVEs, with no exploits disclosed yet.
1000041
295 followersView on X
Factoría Digital Hosting@factoriadigital150d
Patch
Actualizados los servidores de clientes a la ultima version de cPanel que ha salido hace 2h. Vulnerabilidades corregidas de riesgo ALTO: CVE-2026-29205, CVE-2026-29206, CVE-2026-32991, CVE-2026-32992, CVE-2026-32993. No es necesaria ninguna acción. #seguridad #cPanel
Post summary
The text announces that cPanel servers have been updated to the latest version, thereby fixing listed high‑risk CVEs, and indicates no further action is needed.
00010116
799 followersView on X
TropicalServer 🚀@tropicalserver149d
Patch
#cPanel Después de parchear ayer: CVE-2026-29205 CVE-2026-29206 CVE-2026-32991 CVE-2026-32992 CVE-2026-32993 Hoy cPanel nos da la buena nueva de parchear de nuevo todos los servidores con la misma vulnerabilidad: CVE-2026-29205 no es que sea una nueva, es que la de ayer CVE-2026-29205 no esta bien parcheada https://x.com/tropicalserver/status/2052768638764036417?s=20
Post summary
cPanel announced a re‑application of patches for CVE‑2026‑29205 after the first patch was incomplete.
00000113
284 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds150d
Disclosure
CVE-2026-29206 SQL Injection in sqloptimizer Utility Script with Root User Privileges https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-29206
Post summary
The text announces a SQL Injection vulnerability in the sqloptimizer utility that can lead to root privileges, linking to a report but providing no proof‑of‑concept, exploit code, mitigation, or evidence of active exploitation.
0000048
4.0K followersView on X
CVE@CVEnew150d
Disclosure
CVE-2026-29206 Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL Injections on behalf of the root user if Slow Query logging is enabled. https://www.cve.org/CVERecord?id=CVE-2026-29206
Post summary
The post details a SQL injection vulnerability in the sqloptimizer script that can be exploited as root when slow query logging is enabled, but it lacks information on exploits, patches, or active exploitation.
0000071
57.5K followersView on X
Ken Brubacher@KenBrubacher151d
Patch
PSA Patch your servers again! Landing tomorrow at 1pm EST This is getting tedious This release addresses •CVE-2026-29205 •CVE-2026-29206 •CVE-2026-32991 •CVE-2026-32992 •CVE-2026-32993
Post summary
The post is an advisory urging users to apply an upcoming patch that addresses multiple CVEs, with no mention of exploits or technical details.
00000105
84 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-29206

Rıdvan Yağlı[verified]@ridvanyagliDisclosure

The notice alerts cPanel/WHM users to newly disclosed vulnerabilities (CVE-2026-29205, 29206, 32991‑32993), states a patch will be released after 21:00, and advises running /scripts/upcp --force to apply the fix.

kokumօtօ[verified]@__kokumotoPatch

cPanel & WHM have released patches for five critical CVEs, including file-read/SQL injection vulnerabilities, as referenced in the linked security article.

Lyrie.ai[verified]@lyrie_aiPatch

Vendor announces an emergency patch for five high‑severity CVEs affecting cPanel & WHM.

Lyrie.ai[verified]@lyrie_aiPatch

cPanel & WHM will issue an emergency patch for five high‑severity CVEs, with no exploits disclosed yet.

TropicalServer 🚀[verified]@tropicalserverPatch

cPanel announced a re‑application of patches for CVE‑2026‑29205 after the first patch was incomplete.

Factoría Digital Hosting@factoriadigitalPatch

The text announces that cPanel servers have been updated to the latest version, thereby fixing listed high‑risk CVEs, and indicates no further action is needed.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The text announces a SQL Injection vulnerability in the sqloptimizer utility that can lead to root privileges, linking to a report but providing no proof‑of‑concept, exploit code, mitigation, or evidence of active exploitation.

CVE@CVEnewDisclosure

The post details a SQL injection vulnerability in the sqloptimizer script that can be exploited as root when slow query logging is enabled, but it lacks information on exploits, patches, or active exploitation.