Are hosting panels (cPanel, Plesk, CyberPanel) safe right now?
No hosting panel flaws have been added to CISA's exploited list in the last 90 days (the most recent was Jun 15, 2026). Keep automatic updates on: that can change any day.
Earlier exploited flaws
- LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability Zero-day
- LiteSpeed cPanel Plugin Privilege Escalation Vulnerability Zero-day
- WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability Zero-day
- CyberPanel Incorrect Default Permissions Vulnerability
- CyberPanel Incorrect Default Permissions Vulnerability
- Webmin Command Injection Vulnerability
By year
| Year | Exploited flaws added | Zero-days |
|---|---|---|
| 2026 (so far) | 3 | 3 |
| 2025 | 0 | 0 |
| 2024 | 2 | 0 |
| 2023 | 0 | 0 |
| 2022 | 1 | 0 |
Questions
Are hosting panels (cPanel, Plesk, CyberPanel) safe right now?
No hosting panel flaws have been added to CISA's exploited list in the last 90 days (the most recent was Jun 15, 2026). Keep automatic updates on: that can change any day. Confirm with the vendor's own advisories and install updates as soon as they're available.
How many hosting panels vulnerabilities have been exploited?
6 flaws are on CISA's list of vulnerabilities known to be exploited in real attacks, 4 of them used by ransomware.
Covers products matching cpanel, plesk, cyberpanel, webmin. Sources: CISA's Known Exploited Vulnerabilities catalog and the vendors' own advisories. Updated every hour. General information only; confirm details with the vendor.