Paper/Archive/CVE-2026-67399

CVE-2026-67399

WebPros WHMCS — Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code.

EPSS 0.8%CVSS 9.3

critical.is priorityof 100

CVSS 9.3 (CNA)9.3 / 10 × 3027.9 Not in CISA KEV+300.0 EPSS percentile 55.0.550 × 2011.0 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code.

Affected

ProductAffectedFixed inSource

WHMCS9.0.0 – < 9.0.89.0.8CNA

WHMCS8.0.0 – < 8.13.78.13.7CNA

Scores by source

hackerone (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refhelp.whmcs.com/m/125386/l/2118034-cve-2026-67399-whmcs-security-update-2026-09-03