This notice is to inform you of a critical security vulnerability recently identified in all cPanel servers:
CVE-2026-32993
An unauthenticated endpoint in cpsrvd was found that could allow the insertion of arbitrary HTTP headers.
Action Taken
Our security team acted immediately upon the disclosure. We are pleased to confirm that remediation is complete:
Shared Hosting: All shared environments have been patched.
Client Virtual Servers (VPS): All managed virtual servers have been secured.
No action is required on your part. Your hosting environment and data remain secure.
The security of your data is our highest priority. If you have any questions regarding this update, please contact our support team.
