Security: CVE-2026-33278 cpanel-unbound 1.25.1 Security Release - May 21, 2026

Situation

An upstream vulnerability was recently reported for Unbound that affects supported cPanel & WHM versions 126 and higher.

Impact

We have pushed out an update, including the updated package for the following cPanel & WHM versions: 

• 11.126.0.63 and higher
• 11.134.0.30 and higher
• 11.136.0.14 and higher

We have also pushed out an update for the following WP Squared version:

• 11.138.1.1 and higher

Note: All further versions of cPanel are patched for this issue as well. Please see the latest changelogs for version information of each cPanel branch:
https://docs.cpanel.net/changelogs/

Call to Action

1. Update the cPanel version on the server to one of the versions listed above. This can be done with the following:

   # /scripts/upcp --force

2. Once completed, verify the cPanel version with the following to ensure the update was successful.

   # /usr/local/cpanel/cpanel -V