WHMCS published a security update for CVE-2026-67399: a vulnerability in WHMCS 8.0.x and later involving the submission of forged payloads without adequate restrictions. Under specific conditions, that path can reach remote code execution on the server. The vendor says an unauthenticated user could leverage the flaw to run arbitrary code on the WHMCS host, with full compromise of the installation and its data.
Patched builds are WHMCS 9.0.8 and WHMCS 8.13.7. WHMCS says the issue was responsibly disclosed through its security program and tells operators to update immediately once the patched release is available.
Confirmed
- CVE: CVE-2026-67399 (WHMCS security update dated 3 September 2026 on the vendor help article).
- Vendor description: forged payload submission without adequate restrictions; under specific conditions, remote code execution on the WHMCS host.
- Auth: unauthenticated — no login required, per WHMCS.
- Impact (vendor): arbitrary code execution on the host; full compromise of the installation and its data.
- Affected: all WHMCS 9.x before 9.0.8; all WHMCS 8.x before 8.13.7.
- Fixed in: WHMCS 9.0.8 and 8.13.7.
- Classification (NVD/OpenCVE enrichment): CWE-502 (deserialization of untrusted data); OpenCVE lists CVSS v4.0 9.3 Critical (vector includes network / no privileges / no user interaction). Prefer the WHMCS advisory for operational wording; treat the score as a catalog metric until NVD’s own page is fully populated.
Unknown
- Public exploit details: WHMCS does not publish a technical root-cause write-up beyond “forged payloads” and RCE under specific conditions. Third-party posts infer insecure deserialization / object injection; that mechanism is not proven in the vendor text alone.
- Active exploitation: neither the WHMCS advisory nor the OpenCVE record (as of this draft) confirms mass in-the-wild abuse or CISA KEV listing. Absence of a public PoC is not proof of safety for unpatched hosts.
- Exact trigger surface: which endpoint, module, or request shape reaches the bad path is not named in the official note — so temporary WAF rules are guesswork unless derived from independent research you trust.
- Related CVEs in the same release train: some secondary write-ups mention a companion customer-data issue fixed in the same builds; this piece sticks to CVE-2026-67399 as documented on WHMCS’s advisory page.
Our take
Unauthenticated RCE on billing/hosting control planes is the kind of bug that turns a deferred maintenance window into an incident. The useful signal is not the CVSS integer — it is that WHMCS already shipped fixed lines and says there is no substitute for upgrading. Treat anything short of 9.0.8 / 8.13.7 as exposed until proven otherwise; do not wait for a public exploit kit to appear in feeds.
