+91 80401 38000sales@servergurus.com24/7 Expert Support
support@servergurus.comClient Portal →
ServerGurus
← All posts
SecurityCVEHostingManaged Services

CVE-2026-67399 is Unauthenticated RCE in WHMCS - Patch Floor 9.0.8 / 8.13.7

By ServerGurus Team1 October 20267 min read
CVE-2026-67399 is Unauthenticated RCE in WHMCS - Patch Floor 9.0.8 / 8.13.7

The Situation

On 3 September 2026, WHMCS published a security advisory for CVE-2026-67399. The CVE record itself landed on 14 September 2026 (HackerOne CNA). This is not a plugin bug. It is the billing panel most hosting companies leave on the public internet.

Vendor wording, verbatim from the advisory:

A security vulnerability (CVE-2026-67399) has been identified in WHMCS 8.0.x and later involving the submission of forged payloads without adequate restrictions. Under specific conditions, an attacker could use this submission to achieve remote code execution on the server.

And the impact line:

An unauthenticated user could leverage this flaw to execute arbitrary code on the WHMCS host, resulting in full compromise of the installation and its data.

The CNA record is CWE-502 (deserialization of untrusted data). CVSS 4.0 9.3 CRITICAL, vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H. Tenable also publishes a CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Those are two scoring systems, not two bugs. Quote the source next to the number.

Not in CISA KEV. Catalog 2026.09.30 (1,730 entries, fetched 2026-10-01) has no WHMCS row and no CVE-2026-67399. CISA's ADP SSVC on the CVE, dated 2026-09-15, is Exploitation: none, Automatable: yes, Technical Impact: total. That is "not confirmed in the wild, but a working unauth total-impact bug if the conditions line up." Do not treat "not KEV" as "safe to defer until next maintenance window."

Reporter credit on the CVE: azizk (@realazizk).

Patch floors

Branch Affected Fixed release Changelog ticket
WHMCS 9.x all builds before 9.0.8 9.0.8 WHMCS-27923
WHMCS 8.x all builds before 8.13.7 8.13.7 WHMCS-27923

CNA affected range: 9.0.0 less than 9.0.8, and 8.0.0 less than 8.13.7. Vendor advisory matches: "All WHMCS 9.x builds prior to 9.0.8" and "All WHMCS 8.x builds prior to 8.13.7."

The 9.0 changelog already lists 9.0.9 after 9.0.8 (MarketConnect caching, Plesk XML-RPC). 8.13.7 is the current 8.13 maintenance line. Floor is 9.0.8 / 8.13.7; take whatever is current on that branch when you patch. Do not stop at 9.0.7 or 8.13.6.

WHMCS 7.x and earlier are not named in the CVE-2026-67399 CNA range. Do not invent a 7.x status for this ID. They are named on the sibling bug below.

Same patch train: CVE-2026-67398 (2Checkout PII)

Same advisory date, same 9.0.8 / 8.13.7 builds, different bug. Changelog ticket WHMCS-27908.

CVE-2026-67398 is CWE-862 missing authorization in the 2Checkout payment gateway. CVSS 4.0 8.2 HIGH (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N). Unauthenticated retrieval of client PII: name, address, city, state, postal code, country, email, phone.

CNA affected: 8.13.0 before 8.13.7, 9.0.0 before 9.0.8, and EOL from 4.5.0. Vendor: a fix exists only on supported versions; if you are on 4.5 or later you must get to 9.0.8 or 8.13.7.

Temporary workaround (vendor): deactivate the 2Checkout module under Configuration → System Settings → Payment Gateways, and reassign services/invoices to another gateway. That workaround is for 67398 only. It does not close 67399.

CISA ADP on 67398 (2026-09-04): Exploitation: none, Automatable: no, Technical Impact: partial.

Why a billing-panel RCE is worse than a site RCE

WHMCS sits above the rest of the stack. A shell on that host is not "one website." Typical contents of a live install:

  • Client names, emails, phone numbers, billing addresses, support tickets.
  • Stored payment tokens / gateway credentials.
  • Server module API tokens for cPanel, Plesk, DirectAdmin, Virtualizor, Proxmox, SolusVM - the same credentials the panel uses to create, suspend, and terminate accounts.
  • Registrar and nameserver credentials.
  • Admin sessions.

An unauthenticated deserialization bug on that box is a hosting-company incident, not a single-tenant ticket. The vendor said "under specific conditions." They did not publish the endpoint, the gadget, or the payload. We will not reconstruct one. The action is still: patch, then look at whether someone already did.

What to do now

1. Inventory the running version, not the last ticket

From the WHMCS install root:

# version string lives here on stock installs
sed -n '1,40p' includes/version.php

Anything below 9.0.8 on the 9.x line, or below 8.13.7 on the 8.x line, is in the CNA range for 67399. The admin footer and Utilities → Update WHMCS should agree with that file. If they do not, trust the file and the updater output, not a spreadsheet from last quarter.

On a fleet:

for d in /home/*/public_html /var/www/*/whmcs /home/*/whmcs; do
  [ -f "$d/includes/version.php" ] || continue
  echo "== $d"
  sed -n '1,40p' "$d/includes/version.php"
done

Adjust the search roots to how you actually lay out billing installs. The point is to find the copies that are not the one you remember.

2. Backup, then patch

Take a filesystem + MySQL dump of each install before the updater runs. WHMCS updates rewrite encoded PHP; there is no useful diff after the fact.

Vendor recommended path: the in-product Automatic Updater (Utilities → Update WHMCS). Docs index: Updating WHMCS. Manual zip from download.whmcs.com if the updater cannot reach outbound HTTPS.

Target:

  • 9.x → 9.0.8 or newer (9.0.9 is already on the changelog).
  • 8.13 LTS → 8.13.7.
  • Anything older than 8.13: you are off the security train. The 67398 advisory is explicit that unsupported lines only get a fix by upgrading onto 8.13.7 or 9.0.8.

After the updater finishes, re-read includes/version.php and confirm the admin footer. Do not close the change on "the button went green."

3. 2Checkout: workaround only until the same build is on

If you cannot take 9.0.8 / 8.13.7 tonight and 2Checkout is active, deactivate it per the 67398 advisory. Reassign invoices to another gateway so you do not freeze collections. Re-enable only after the patched build is confirmed.

4. After patch: look for prior use

CISA did not confirm exploitation. That is not the same as "nobody tried." WHMCS is ionCube-encoded; you will not get a public Nuclei template from the vendor. What you can do without a PoC:

  • Access logs for the billing vhost: spikes of POST to unusual includes/, modules/gateways/, modules/servers/, oauth/, index.php?m= paths from IPs that are not your office, your payment callbacks, or your cron.
  • New PHP files under the WHMCS tree, attachments/, templates_c/, downloads/, and the account's /tmp.
  • New admin users, new API credentials, changed server-module passwords, unexpected registrar/nameserver edits.
  • Crontabs and systemd user units for the WHMCS uid.

If anything in that list is off, treat it as a billing-system compromise: rotate every token WHMCS stored, every admin password, every server-module API key, and review provisioning logs on the hypervisors and cPanel/Plesk masters it talks to. We do not have vendor IOCs to grep. Do not paste a random "WHMCS RCE detector" from a forum into production.

What we don't know

  • No public exploit recipe is cited here. The vendor said "forged payloads" and "specific conditions." The CNA said CWE-502. That is the entire technical disclosure. We will not invent an endpoint or a gadget chain.
  • Not in CISA KEV as of catalog 2026.09.30 / fetch 2026-10-01. CISA ADP on 67399 is Exploitation: none (15 September 2026). That can change; re-check the KEV JSON before you tell a customer the urgency dropped.
  • Tenable EPSS 0.00685 on their CVE page (updated 2026-09-18) is a model output, not a measurement of scanning. Do not use it as a reason to wait.
  • "Under specific conditions" is the vendor's hedge. Unauthenticated + Critical + Automatable:yes is still a same-day patch on any internet-facing WHMCS.
  • We did not verify ionCube-decoded source. WHMCS is closed. Changelog lines WHMCS-27923 / WHMCS-27908 are the vendor's own mapping of CVE to build.
  • This is not the WordPress Core KEV (CVE-2026-87902) and not last week's panel CVEs. Different product, different command.

Sources

  • WHMCS advisory, last updated 2026-09-03 - CVE-2026-67399 Security Update
  • WHMCS advisory - CVE-2026-67398 Security Update
  • CVE JSON (HackerOne CNA) - CVE-2026-67399 (published 2026-09-14; CVSS 4.0 9.3; CWE-502; CISA-ADP Exploitation none / Automatable yes / total impact, 2026-09-15)
  • CVE JSON - CVE-2026-67398 (published 2026-09-03; CVSS 4.0 8.2; CWE-862; workaround: deactivate 2Checkout)
  • WHMCS 9.0 change log - 9.0.8 WHMCS-27923 / WHMCS-27908; 9.0.9 already listed
  • WHMCS 8.13 change log - 8.13.7 same two tickets
  • CISA KEV JSON - https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json (catalogVersion 2026.09.30, dateReleased 2026-09-30T16:59:23Z; no WHMCS / CVE-2026-67399 row)
  • Tenable CVE-2026-67399 - CVSS 3.1 9.8, CVSS 4.0 9.3, EPSS 0.00685, published 2026-09-14, updated 2026-09-18
  • Updating WHMCS - Automatic Updater and manual update index

Ready to build your infrastructure?

Get a quote from our Hyderabad-based team - Tier IV datacenter, real support, INR or USD billing.

View pricingRequest a quoteWhatsApp sales