CVE Catalog
CVE-2026-67399
CriticalCVSS 9.3Summary
Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code.
Risk Assessment
A remote attacker can execute arbitrary code on the WHMCS server, potentially leading to full system compromise and breach of customer data.
Recommendation
Update WHMCS to version 9.0.8 or 8.13.7 (or later) to eliminate the deserialization vulnerability.
Other vulnerabilities in WHMCS
Original NVD description (English source)
Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code.