VulnSocial

CVE-2026-67399Patch

LOW

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

Back to dashboard
0.5/ 10 priority

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 6 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 5 signals
  • Technical details provided in 5 signals
  • Disclosure: 1 classified signal
  • Peaked 2d ago at 2 mentions (2026-09-04); latest day: 1
  • 6 total mentions across 4 days

Deep dive

Activity timeline6 mentions / 4d
01122Mentions · 2026-09-03: 1Mentions · 2026-09-04: 2Mentions · 2026-09-15: 2Mentions · 2026-09-16: 1Patch / Workaround · 2026-09-03: 1Patch / Workaround · 2026-09-04: 1Patch / Workaround · 2026-09-15: 2Patch / Workaround · 2026-09-16: 1Technical Details · 2026-09-03: 1Technical Details · 2026-09-04: 1Technical Details · 2026-09-15: 2Technical Details · 2026-09-16: 109-0309-0409-1509-16
Signal classification2 categories
Patch
583.3%
Disclosure
116.7%
Referenced assets5 URLs
Classification over time
DateTotalLabels
2026-09-031
Patch1
2026-09-042
Disclosure1Patch1
2026-09-152
Patch2
2026-09-161
Patch1
Full discourse6 posts
  • Rıdvan Yağlı@ridvanyagli
    Patch

    🔴 WHMCS'te kritik güvenlik açıkları: CVE-2026-67398 & CVE-2026-67399 WHMCS, bugün iki güvenlik açığı için acil güncelleme yayınladı. 🚨 CVE-2026-67399 Kimlik doğrulaması gerektirmeyen bir saldırgan, özel hazırlanmış bir payload ve deserialization zincirini kullanarak WHMCS sunucusunda uzaktan kod çalıştırabiliyor (RCE). Başarılı istismar, WHMCS kurulumunun ve üzerindeki verilerin tamamen ele geçirilmesine yol açabilir. Etkilenen sürümler: • WHMCS 8.x -> 8.13.7 öncesi • WHMCS 9.x -> 9.0.8 öncesi 🚨 CVE-2026-67398 2Checkout entegrasyonundaki bir açık, kimlik doğrulaması olmayan saldırganların belirli koşullarda fatura ID'lerini enumerate ederek müşteri verilerine erişmesine neden olabiliyor. Bu açık için WHMCS 4.5 ve sonrası sürümler etkilenmiş olarak belirtiliyor. ✅ Önerilen sürümler: • 8.13.7 • 9.0.8 2Checkout kullanmıyorsanız CVE-2026-67398 için acil workaround gerekmiyor; ancak WHMCS'in kendisi güncellemenin mümkün olan en kısa sürede uygulanmasını öneriyor. ⚠️ Özellikle CVE-2026-67399 nedeniyle internete açık WHMCS 8.x/9.x kurulumlarının gecikmeden güncellenmesi gerekiyor. Kaynaklar: WHMCS Security Advisory, 3 Eylül 2026. https://help.whmcs.com/m/125386/l/2116695-cve-2026-67398-whmcs-security-update-2026-09-03 https://help.whmcs.com/m/125386/l/2118034-cve-2026-67399-whmcs-security-update-2026-09-03

    Post summary

    The advisory announces two critical CVEs affecting WHMCS, explains their exploitation paths and impacts, and provides updated versions for immediate patching.

    0201851.5K
    2.4K followersView on X
  • Daily CyberSecurity@Daily_CyberSec
    Patch

    A critical WHMCS security update fixes CVE-2026-67399 and CVE-2026-67398. Apply the patch now to prevent remote code execution and data leaks. #WHMCS #CyberSecurity #CVE202667399 #CVE202667398 #InfoSec https://securityonline.info/whmcs-security-update-cve-2026-67399/ https://t.co/BNvTvGIUBc

    Post summary

    A WHMCS update addresses CVE‑2026‑67399 and CVE‑2026‑67398, which allow remote code execution and data leaks; the patch should be applied immediately.

    13071814
    13.0K followersView on X
  • CCB Alert@CCBalert
    Patch

    Warning: A critical deserialisation flaw in #WHMCS allows unauthenticated remote code execution (CVE-2026-67399, CVSS(4.0): 9.3). A high 2Checkout gateway flaw exposes client PII (CVE-2026-67398, CVSS(4.0): 8.2). Read the advisory https://help.whmcs.com/m/125386/l/2118034-cve-2026-67399-whmcs-security-update-2026-09-03 and #Patch #Patch #Patch

    Post summary

    The text warns of two critical vulnerabilities in WHMCS (CVE-2026-67399 and CVE-2026-67398), provides technical details, and links to an official security update (patch) with a remediation call via #Patch hashtags.

    01000284
    7.3K followersView on X
  • Brocker Editorial Team@brockerorg
    Patch

    WHMCS shipped 9.0.8 and 8.13.7 for CVE-2026-67399 — an unauthenticated flaw where forged payloads can lead to remote code execution and full compromise of the installation. https://www.brocker.org/whmcs-cve-2026-67399-unauthenticated-rce-forged-payloads

    Post summary

    WHMCS released versions 9.0.8 and 8.13.7 to patch CVE-2026-67399, an unauthenticated RCE vulnerability caused by forged payloads. The tweet confirms the fix and provides technical details about the vulnerability.

    0000040
    23 followersView on X
  • NEXSIGHT@NEXSIGHTNEWS
    Patch

    ホスティング事業者向け請求管理ソフト「WHMCS」に認証不要の脆弱性2件 — WebProsが修正版9.0.8と8.13.7を公開、1件はサーバ上の任意コード実行 https://cyber.nexsight.co/articles/2026/09/15/whmcs-cve-2026-67399-67398-unauth-rce-pii-2026-09-15/

    Post summary

    The text reports two unauthenticated WHMCS vulnerabilities, including one server-side arbitrary code execution issue, and states that fixed versions 9.0.8 and 8.13.7 were released.

    0000068
    70 followersView on X
  • azizk@realazizk
    Disclosure

    @boomerangBS @whmcs yes it was just released CVE-2026-67399

    Post summary

    The tweet simply announces the release of CVE-2026-67399 without providing further details.

    00000194
    118 followersView on X

Explore more

Back to dashboard