Multiple Cpanel/WHM Vulnerabilities Allow Arbitrary Command Execution On Server
cPanel patched a root command-execution flaw and two stored XSS bugs in WHM.
cPanel disclosed three vulnerabilities in cPanel and WHM on September 29, 2026, affecting every supported release before the patched builds. CVE-2026-93698 in the Multilang adminbin component allows arbitrary command execution as root, which can expose all hosted accounts, sites, and databases. CVE-2026-93029 and CVE-2026-93697 are stored cross-site scripting flaws in Manage SSL Hosts and Mass Modify Accounts that execute in an administrator's session. No public exploit was reported; fixes are in 11.110.0.148, 11.134.0.61, 11.136.0.45, 11.138.0.11, and WP2 11.138.1.13 or later.
- CVE-2026-93698 allows root command execution through weak validation in Multilang adminbin.
- Two stored XSS flaws can run in a WHM administrator's authenticated browser session.
- Every supported version is affected until the listed patched releases or later.
- No public proof-of-concept was identified at the time of reporting.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-93029+1 related CVE | Stored XSS in cPanel WHM Manage SSL Hosts | 9.0 | — | ||
| CVE-2026-93698 | Authenticated OS command injection in Multilang adminbin | 9.9 | — |
From the original article
2 min read at cybersecuritynews.com
Multiple security flaws in cPanel & WHM could let attackers run malicious scripts in an administrator’s browser session or execute arbitrary commands as root. The vulnerabilities were disclosed on September 29, 2026, and affect all supported cPanel & WHM versions before the vendor’s patched releases. Administrators should update immediately, as a successful attack against the […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.