External risk intelligence

WHMCS Deserialization Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-67399

WHMCS is a web-based billing and automation platform designed to be publicly accessible for customer management, billing, and support portal interactions. As a web application intended to be hosted on the internet for clients to access, its primary interfaces are designed for external network connectivity.

Deserialization

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability involves the deserialization of untrusted data in WHMCS, a web-based platform for billing and automation. It could allow remote attackers to execute arbitrary code, posing a significant risk to systems that handle sensitive customer and financial information. The main concern is confirming relevance and exposure.

Code execution via untrusted data.
Affects web billing and automation systems.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted data over the network to a vulnerable WHMCS installation. Because the system improperly handles untrusted data during deserialization, an attacker can execute arbitrary code on the server.

No authentication or user interaction needed.
Triggered by deserializing untrusted data.
Allows remote code execution.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker could execute arbitrary code on systems running affected versions of WHMCS by exploiting a deserialization vulnerability. This could occur when the application processes untrusted data, potentially leading to unauthorized code execution. The advisory does not indicate risks to PII or specific system data types beyond code execution.

Arbitrary code execution on the server.
Processing untrusted data during deserialization.
Server compromise or malicious actions.

Operational Fix

Recommended remediation, mitigation, and detection steps

Attackers can execute arbitrary code by exploiting a deserialization vulnerability in WHMCS. The first step is to identify all instances of the affected WHMCS software, determine their exposure and business criticality, and then assign ownership for remediation.

Application owners or platform teams should address this.
Verify external-facing or critical instances first.
Plan remediation during the next maintenance window.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is WHMCS?

WHMCS is a web-based automation and billing platform widely used by service providers to manage client accounts, recurring payments, domain registration, and support tickets. Because it acts as a central hub for business operations and customer portals, it is typically hosted on web servers where it must process various inputs from clients and administrators to perform its management tasks.

How does deserialization lead to code execution in CVE-2026-67399?

This vulnerability involves the weakness class CWE-502, Deserialization of Untrusted Data. In plain terms, the application takes complex data formats—often used to save state or transfer objects—and reconstructs them without sufficient checks. When the software trusts this incoming data blindly, an attacker can craft a malicious object that, when deserialized, forces the server to run unauthorized commands, effectively gaining control over the application's execution flow.

Do I need to be logged in for an attacker to trigger this bug?

No. The vulnerability does not require authentication or any specific user interaction to trigger. An attacker simply needs to send specially crafted data over the network to the vulnerable WHMCS instance. Simply visiting the site or interacting with standard features as a legitimate user is not the trigger; the attack succeeds when the system processes the malicious, untrusted data package as if it were legitimate internal data.

Is my WHMCS instance at high risk?

According to Halo Surface Signal, instances are very likely at risk because WHMCS is designed to be a publicly accessible portal for billing and support. Because these systems are intentionally exposed to the internet to allow clients to log in and manage services, they are reachable by remote attackers, significantly increasing the probability that an unauthorized actor could attempt to reach the vulnerable code path.

What steps should I take if I run an affected version of WHMCS?

You should begin by performing an inventory of all WHMCS installations in your environment to identify those running versions affected by CVE-2026-67399. Prioritize the remediation of instances that are internet-facing or manage critical business data. Once identified, coordinate with your application or platform teams to plan an update during your next available maintenance window to apply the vendor-provided security patches.

References

help.whmcs.com/m/125386/l/2118034-cve-2026-67399-whmcs-security-upda…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.