Critical severity · published Sep 14, 2026
CVE-2026-67399
Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code
9.3
CVSS
0.8%
EPSS
No
On KEV
Description
Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WH
WHMCS · WebPros
9.0.0 before 9.0.8; 8.0.0 before 8.13.7 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-67399
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-67399
help.whmcs.com
https://help.whmcs.com/m/125386/l/2118034-cve-2026-67399-whmcs-security-update-2026-09-03
More from WHMCS
9.1
CVE-2026-29204
Insufficient ownership check in `clientarea.php` allows an authenticated client area user to submit requests using another user’s `addonId` without any ownership validation…
8.2
CVE-2026-67398
Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.7, from 9.0.0 before 9.0.8, all other EOL versions from 4.5.0