New Cpanel Vulnerability Allows Attackers to Access Other Users’ Accounts

CVE-2026-65638 is an unauthenticated shell command injection flaw (CWE-78) in ConfigServer Security & Firewall (CSF), caused by improper escaping of a request URL. An attacker who sends a crafted request URL containing shell metacharacters to the affected web-facing component can have arbitrary commands executed under the CSF service account. Successful exploitation therefore yields command execution on the server in the context of the CSF service account, with a critical CVSS 4.0 score of 9.2 reflecting high confidentiality, integrity, and availability impact on the vulnerable system. The flaw affects versions originally distributed by ConfigServer as well as versions of the WebPros-maintained fork that contain the vulnerable code; WebPros has fixed it in version 16.30, and other independently maintained CSF forks should be evaluated separately. There is no public proof of concept, the issue is not in CISA's Known Exploited Vulnerabilities catalog, and no exploitation has been reported to date.

Do: Upgrade the WebPros-maintained CSF fork to version 16.30 or later and verify which fork and version your deployment actually uses. If you run the original ConfigServer distribution or a third-party fork, monitor the respective maintainer for a patched release and assess your version independently. Until patched, restrict unauthenticated access to the CSF web interface (e.g., limit it to trusted management networks or localhost/VPN) and watch for unexpected command execution by the CSF service account.

cPanel 11.138.0.0 and earlier contains an eval injection flaw (CWE-95) in which attacker-controlled input reaches dynamic code evaluation without proper neutralization. A remote attacker holding any authenticated account on a cPanel server, such as an ordinary hosting customer, can trigger the flaw with crafted input and no user interaction. Successful exploitation yields arbitrary code execution as root, meaning a single low-privilege tenant can compromise the entire server and every site hosted on it. All deployments running version 11.138.0.0 or earlier are affected, which at disclosure covers essentially all active cPanel servers given that this was the current release. No public proof-of-concept or confirmed in-the-wild exploitation is known; the issue is not in CISA KEV and EPSS assigns only a 0.9% probability of exploitation within 30 days.

Do: Upgrade cPanel/WHM to a fixed release above 11.138.0.0 published under WebPros advisory AV26-861, prioritizing multi-tenant shared servers where any customer account can reach the vulnerable code. Until patched, restrict shell and feature access for untrusted accounts and review authentication logs and unexpected root-owned processes. No workaround is documented in the available data, so updating is the primary action.

CVE-2026-67401 is a critical SQL injection (CWE-89) in the EmailTrack component of cPanel, the widely used hosting control panel. An attacker holding any mail-enabled account on the server can reach the vulnerable component over the network with low privileges and no user interaction (CVSS: AV:N/AC:L/PR:L/UI:N), and the injection crosses a privilege boundary (Scope: Changed) to achieve remote code execution as root. Successful exploitation yields full compromise of the host — arbitrary commands as root with complete access to all hosted data — so every site, mailbox and account on an affected server is exposed. All cPanel deployments with mail enabled are potentially affected; the available data does not specify exact vulnerable version ranges, which are provided in WebPros security advisory AV26-908. Exploitation has not been confirmed in the wild (not in CISA KEV), but two public proof-of-concept exploits are already on GitHub, making near-term exploitation likely.

Do: Upgrade cPanel to the patched release identified in WebPros advisory AV26-908 (exact fixed version numbers are not given in the available data), prioritizing internet-facing servers that host mail-enabled accounts. Until patched, restrict access to the EmailTrack component and audit mail-enabled accounts and logs for suspicious database queries or unexpected root-level processes, since public PoC exploits are already available.

CVE-2026-68490 is an incorrect permission assignment (CWE-732) affecting the CalDAV/CardDAV calendar and address book service in cPanel & WHM, based on the related reporting naming cPanel. Any user who already has an account on the same server (for example, another shared-hosting tenant or a low-privilege local user) can access other accounts' calendar and contact data, because the service fails to enforce per-account boundaries on those resources. The attack is local, requires only low privileges, and no user interaction, yielding high confidentiality impact — including exposure of data in connected/subsequent systems per the CVSS 4.0 vector — but no integrity or availability impact. Practically, an attacker gains other tenants' calendars and address books, which frequently contain sensitive personal, corporate, and credential-adjacent information (meeting details, contacts, reset addresses). There is no CISA KEV entry and no public proof of concept, so exploitation status is currently none known.

Do: Update cPanel & WHM to the latest release in your supported tier (Current or LTS) and check the vendor changelog for the CalDAV/CardDAV permission fix once the exact fixed build is published. Audit calendar/contact (CalDAV/CardDAV) data directories and service logs for cross-account access by non-owner accounts, since a successful abuse leaves read traces. If the calendar and contacts service is not needed on your server, disable it to eliminate this attack surface, and treat any compromised address books as potential pivot data for phishing against your tenants.

CVE-2026-87899 is an execution-with-unnecessary-privileges flaw (CWE-250) in cPanel that lets any remote authenticated user — for example an ordinary hosting account on a shared server, or an attacker who has compromised one — execute arbitrary code with root privileges. The attack requires only low-privilege credentials and no user interaction, and a successful exploit yields complete control of the underlying server, including every other tenant's accounts, websites, databases, and email, which is consistent with reporting that the flaw enables cross-account access. This primarily threatens multi-tenant shared hosting environments where cPanel & WHM is the dominant control panel. The bug is rated critical (CVSS 4.0: 9.4) and a vendor fix has been released, but it is not on the CISA KEV list and no public proof-of-concept is known. No exploitation in the wild has been reported so far, though the pool of potentially affected servers is very large.

Do: Update all cPanel & WHM servers to the latest vendor release (via the CURRENT/RELEASE/LTS tier you track) as soon as the fix reaches your update tier, and confirm the update applied in WHM's update log. Because exploitation needs only a low-privileged hosting account, audit tenant accounts for weak or compromised credentials, enforce least privilege, and review for post-exploitation indicators such as unexpected root-owned processes, new SUID binaries, added cron jobs, modified SSH authorized_keys, and anomalous outbound traffic from the server.

CVE-2026-87900 is an argument injection flaw (CWE-88) in the WP Toolkit add-on for cPanel servers, affecting version 6.11.2-10794 and earlier. A remote attacker needs only a low-privileged, authenticated hosting account on an affected server and sends specially crafted arguments to WP Toolkit operations, with no user interaction required. Successful exploitation lets the attacker read arbitrary files and execute arbitrary code across other customer accounts on the same server, and press reports indicate the issue can escalate to running code as root and taking full control of the hosting server. The affected population is hosting providers running cPanel with WP Toolkit installed, along with all of their hosted customers. The flaw is rated critical (CVSS 4.0: 9.4), but it is not on the CISA KEV list, no public proof of concept exists, and no exploitation in the wild has been reported so far.

Do: Hosting providers should immediately update WP Toolkit for cPanel to any build newer than 6.11.2-10794 via WHM and verify the installed version. Because exploitation only requires an ordinary authenticated hosting account, review server logs for unusual WP Toolkit activity, cross-account file access, or unexpected processes/cron jobs, and rotate credentials if compromise is suspected. Customers on shared hosts that have not patched should treat files and credentials in their accounts as potentially exposed until the provider confirms remediation.