New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server Control

CVE-2026-68490 is an incorrect permission assignment (CWE-732) affecting the CalDAV/CardDAV calendar and address book service in cPanel & WHM, based on the related reporting naming cPanel. Any user who already has an account on the same server (for example, another shared-hosting tenant or a low-privilege local user) can access other accounts' calendar and contact data, because the service fails to enforce per-account boundaries on those resources. The attack is local, requires only low privileges, and no user interaction, yielding high confidentiality impact — including exposure of data in connected/subsequent systems per the CVSS 4.0 vector — but no integrity or availability impact. Practically, an attacker gains other tenants' calendars and address books, which frequently contain sensitive personal, corporate, and credential-adjacent information (meeting details, contacts, reset addresses). There is no CISA KEV entry and no public proof of concept, so exploitation status is currently none known.

Do: Update cPanel & WHM to the latest release in your supported tier (Current or LTS) and check the vendor changelog for the CalDAV/CardDAV permission fix once the exact fixed build is published. Audit calendar/contact (CalDAV/CardDAV) data directories and service logs for cross-account access by non-owner accounts, since a successful abuse leaves read traces. If the calendar and contacts service is not needed on your server, disable it to eliminate this attack surface, and treat any compromised address books as potential pivot data for phishing against your tenants.

CVE-2026-87899 is an execution-with-unnecessary-privileges flaw (CWE-250) in cPanel that lets any remote authenticated user — for example an ordinary hosting account on a shared server, or an attacker who has compromised one — execute arbitrary code with root privileges. The attack requires only low-privilege credentials and no user interaction, and a successful exploit yields complete control of the underlying server, including every other tenant's accounts, websites, databases, and email, which is consistent with reporting that the flaw enables cross-account access. This primarily threatens multi-tenant shared hosting environments where cPanel & WHM is the dominant control panel. The bug is rated critical (CVSS 4.0: 9.4) and a vendor fix has been released, but it is not on the CISA KEV list and no public proof-of-concept is known. No exploitation in the wild has been reported so far, though the pool of potentially affected servers is very large.

Do: Update all cPanel & WHM servers to the latest vendor release (via the CURRENT/RELEASE/LTS tier you track) as soon as the fix reaches your update tier, and confirm the update applied in WHM's update log. Because exploitation needs only a low-privileged hosting account, audit tenant accounts for weak or compromised credentials, enforce least privilege, and review for post-exploitation indicators such as unexpected root-owned processes, new SUID binaries, added cron jobs, modified SSH authorized_keys, and anomalous outbound traffic from the server.

CVE-2026-87900 is an argument injection flaw (CWE-88) in the WP Toolkit add-on for cPanel servers, affecting version 6.11.2-10794 and earlier. A remote attacker needs only a low-privileged, authenticated hosting account on an affected server and sends specially crafted arguments to WP Toolkit operations, with no user interaction required. Successful exploitation lets the attacker read arbitrary files and execute arbitrary code across other customer accounts on the same server, and press reports indicate the issue can escalate to running code as root and taking full control of the hosting server. The affected population is hosting providers running cPanel with WP Toolkit installed, along with all of their hosted customers. The flaw is rated critical (CVSS 4.0: 9.4), but it is not on the CISA KEV list, no public proof of concept exists, and no exploitation in the wild has been reported so far.

Do: Hosting providers should immediately update WP Toolkit for cPanel to any build newer than 6.11.2-10794 via WHM and verify the installed version. Because exploitation only requires an ordinary authenticated hosting account, review server logs for unusual WP Toolkit activity, cross-account file access, or unexpected processes/cron jobs, and rotate credentials if compromise is suspected. Customers on shared hosts that have not patched should treat files and credentials in their accounts as potentially exposed until the provider confirms remediation.