CVE-2026-67399

CriticalCVSS 9.3

Published: 14/09/2026(UTC)Updated: 18/09/2026(UTC)Translated: 15/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.69%

51th percentile - higher than 51% of all known CVEs

Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code.

A remote attacker can execute arbitrary code on the WHMCS server, potentially leading to full system compromise and breach of customer data.

Update WHMCS to version 9.0.8 or 8.13.7 (or later) to eliminate the deserialization vulnerability.

Original NVD description (English source)

Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS