Multiple cPanel & WHM Vulnerabilities Enable Root Code Execution and Admin Session Hijacking
cPanel patched a critical root command-execution flaw and two WHM stored XSS bugs across supported versions.
cPanel patched three vulnerabilities affecting all supported cPanel & WHM versions before the fixed builds. CVE-2026-93698 (CVSS 9.9) is an input-validation flaw in Multilang adminbin that can execute arbitrary commands as root. CVE-2026-93029 and CVE-2026-93697 are stored XSS bugs in Manage SSL Hosts and Mass Modify Accounts that run in an administrator’s authenticated WHM session. Fixes are in 11.110.0.148, 11.134.0.61, 11.136.0.45, and 11.138.0.11 or later, and WP Squared 11.138.1.13 or later; the September 29, 2026 advisories do not report exploitation in the wild.
- CVE-2026-93698 allows root command execution via Multilang adminbin, CVSS 9.9.
- Two stored XSS bugs can run in authenticated WHM administrator sessions.
- Fixes are in 11.110.0.148, 11.134.0.61, 11.136.0.45, and 11.138.0.11 or later.
- The September 29, 2026 advisories do not report in-the-wild exploitation.
- Vendors
- cPanel
- Products
- cPanel & WHMWP Squared
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-93029+1 related CVE | Stored XSS in cPanel WHM Manage SSL Hosts | 9.0 | — | ||
| CVE-2026-93698 | Authenticated OS command injection in Multilang adminbin | 9.9 | — |
From the original article
2 min read at gbhackers.com
cPanel has released security updates to address three vulnerabilities in cPanel & WHM that could allow attackers to hijack WHM administrator sessions or execute commands as the root user. Organizations using affected deployments should prioritize upgrades, as these flaws affect all supported versions of cPanel & WHM before the newly released fixed versions. cPanel & […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.