New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server Control
cPanel patched three flaws, including a root code-execution bug any hosting account can use to seize the server.
cPanel disclosed three flaws on September 22, 2026, and released fixes. CVE-2026-87899 in CalDAV and CardDAV lets a logged-in hosting account run code as root on cPanel & WHM version 120 and later. CVE-2026-87900 in WP Toolkit 6.11.2 and older lets an account change other accounts' databases, while CVE-2026-68490 lets a local user read other accounts' calendars and contacts. cPanel reports no exploitation, the issues were not in CISA's KEV catalog, and no temporary workaround is offered.
- CVE-2026-87899 lets any cPanel account execute code as root.
- CVE-2026-87900 lets a user modify other accounts' databases.
- CVE-2026-68490 lets a local user read other accounts' calendars and contacts.
- Fixes cover cPanel lines 134, 136, and 138, plus WP Toolkit 6.11.3.
- No exploitation is reported, and cPanel offers no workaround.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-68490 | CalDAV/CardDAV Permission Flaw in cPanel Lets Local Users Read Other Accounts' Data | 8.2 | — | ||
| CVE-2026-87899 | Authenticated Privilege Escalation to Root RCE in cPanel & WHM | 9.4 | — | ||
| CVE-2026-87900 | Argument Injection in WP Toolkit for cPanel Allows Cross-Account File Read and RCE | 9.4 | — |
From the original article
3 min read at thehackernews.com
A flaw in cPanel's CalDAV and CardDAV service lets anyone with a cPanel hosting account run code as root and take "full control of the server," the company said on September 22. A second bug in the WP Toolkit plugin, used to install and manage WordPress sites, allows an account holder to change databases that belong to other accounts. cPanel has released fixed versions for both,
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.