This vulnerability (CVE-2026-67399) in WHMCS is due to unsafe deserialization of untrusted data, classified under CWE-502. It affects versions 8.0.0 through 8.13.6 and 9.0.0 through 9.0.7. Remote attackers can exploit this flaw to execute arbitrary code on the affected systems without requiring privileges or user interaction. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to execute arbitrary code on vulnerable WHMCS installations, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability of the affected systems. No known exploits in the wild have been reported at this time.

Upgrading WHMCS to version 8.13.7 or later for the 8.x branch, or 9.0.8 or later for the 9.x branch, is required to remediate this vulnerability. Since this is a software vulnerability in on-premises installations, administrators should apply these official patches promptly. No vendor advisory content was provided, so patch status is inferred from version ranges; verify with the vendor for the latest remediation guidance.