CVE-2026-93029

CVE-2026-93029 is a stored cross-site scripting flaw (CWE-79) in the Manage SSL Hosts interface of WHM, the administrative console bundled with cPanel. An attacker who already has a low-privileged account can save malicious content that is later rendered in that interface, and the script runs in an administrator’s browser when they open the page. The issue is scored critical (CVSS 9.0, network, low complexity, user interaction required, scope changed, high impact on confidentiality, integrity, and availability), so a successful attack can abuse the administrator’s WHM session for privileged server actions, which the description characterizes as arbitrary code execution. Operators of servers running WHM who use Manage SSL Hosts are affected; no version range is published. There is no known public proof of concept, and the flaw is not listed in CISA’s Known Exploited Vulnerabilities catalog.

What to do: Apply the vendor security update for cPanel/WHM as soon as a fixed build is published; the advisory data does not name a patched version. Until then, restrict WHM to trusted administrator networks (VPN or IP allowlists), limit which accounts can create or edit SSL host records, and review existing Manage SSL Hosts entries for unexpected HTML or script. If an administrator viewed that page while untrusted data was stored there, treat the WHM session as potentially compromised and rotate credentials.