EUVD-2026-115630
GHSA-rcwx-58mq-xwr6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach cPanel/WHM web service
-
ExploitSend request with embedded NUL byte
-
ExecutionBypass mail-account access control
-
ImpactRead arbitrary calendar and contact data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Metacharacter neutralization
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against cPanel/WHM as reflected by AV:N/AC:L/PR:N/UI:N. The attacker only needs network reachability to the cPanel/WHM service. Exploitation is limited to confidentiality of calendar and contact data for mail accounts (VC:H, VI:N/VA:N); it does not permit modification or service disruption. The available sources do not specify whether a non-default configuration, particular cPanel version, or specific calendar/contact (CalDAV/CardDAV) feature must be enabled, so no additional configuration prerequisite can be confirmed from the data. |
| Impact | This is a genuine priority, not a high-CVSS-but-low-real-risk issue. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction, and the cPanel advisory title independently corroborates 'Unauthenticated Access.' Impact is scoped to confidentiality only (VC:H, VI:N, VA:N) - attackers read calendar and contact data but cannot modify data or affect availability, consistent with the CWE-158 (improper neutralization of NUL byte) information-disclosure mechanism. Not all decision signals are present: there is no CISA KEV listing, no EPSS probability, and no public exploit reference in the supplied data, so exploitation is not confirmed in the wild. The vuln.today priority of 'this_week' aligns with a serious-but-not-emergency unauthenticated disclosure flaw. The combination of unauthenticated network access and cPanel's very large hosting footprint is what drives real-world risk here, even absent confirmed exploitation. EPSS is unavailable, so probabilistic exploitation likelihood cannot be weighed. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted request containing an embedded NUL byte to the cPanel/WHM service, abusing improper neutralization to bypass access controls and retrieve any mail account's calendar and contact records. No credentials or user interaction are required (PR:N/UI:N). No public exploit code is identified in the available data, so the specific request format is not documented in the provided sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 02, 2026
Unauthenticated access to calendar and contact data in cPanel/WHM lets remote attackers read the calendar and contact data of any mail account by supplying a crafted NUL byte that bypasses input neutralization. Affected deployments are cPanel/WHM servers exposing the calendar and contact (CalDAV/CardDAV) functionality, and exploitation requires only network reachability to the service, with high confidentiality impact but no modification or disruption. No public exploit code or confirmed active exploitation appears in the supplied sources, all of which are vendor and NVD references; the referenced vendor advisory is dated October 20th, 2026, and the vulnerability is tagged as an information disclosure issue.
RemediationAI
The supplied data contains no fixed version, so the primary action is to obtain the patched build from the vendor advisory at https://support.cpanel.net/hc/en-us/articles/44356591132439-Security-CVE-2026-105475-Unauthenticated-Access-to-Calendar-and-Contact-Data-in-cPanel-WHM-October-20th-2026 and apply cPanel's published update for CVE-2026-105475; no exact fix version can be cited from the available data. Because the flaw is reachable unauthenticated over the network, a compensating control until patched is to restrict network reachability to the cPanel/WHM calendar and contact (CalDAV/CardDAV) endpoints to trusted addresses, with the trade-off that legitimate mail clients outside those networks lose calendar and contact synchronization. The sources do not identify a specific endpoint, toggle, or configuration setting to disable, so any such restriction should be validated against the vendor guidance before deployment.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-158, improper neutralization of a NUL byte (also described as an injected null character), in cPanel/WHM. In this class of defect, an attacker-supplied NUL terminates or truncates a string before the security-relevant comparison or path/identity resolution completes, so a request that should be rejected or scoped to one account is instead processed against another. Here the observable result is disclosure of calendar and contact data belonging to arbitrary mail accounts. The supplied CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:N with VC:H and no integrity or availability impact, matching the independent CVSS 3.1 assessment of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, so the flaw is remotely reachable without credentials and affects only confidentiality. The available sources do not describe the specific parsing path, the underlying language or library, or whether a particular non-default configuration or calendar/contact feature must be enabled, so the exact trigger and any deployment prerequisites are not confirmed from the data.
Know when Cpanel gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Unauthenticated network access with low complexity and no user interaction (PR:N/UI:N); impact is confidentiality-only disclosure of calendar/contact data, so I:N and A:N.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
2DescriptionCVE.org
Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data.
Executive ViewAI
CVE-2026-105475 is a high-severity flaw in cPanel/WHM's CalDAV/CardDAV services that allows unauthenticated attackers to read the calendar and contact data of any mail account on affected servers. Any organization hosting email on cPanel/WHM with these services exposed is at risk of confidential schedule and contact information disclosure, which could enable targeted phishing, social engineering, or business email compromise. Leadership should prioritize remediation because the vulnerability is remotely exploitable without credentials and directly impacts data confidentiality across the entire user base.
No vendor-released patch identified at time of analysis; restrict network access to CalDAV/CardDAV services, disable them if not required, and monitor for exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Root-level remote code execution in WebPros cPanel is achievable by any mail-enabled account through a SQL injection fla
An issue was discovered in cPanel before 11.109.9999.116. Rated medium severity (CVSS 6.1), this vulnerability is remote
cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is
OS command injection in cPanel and WP Squared allows an authenticated, low-privileged hosting account holder to execute
OS command injection in the AUTOM8N plugin for WHM/cPanel (all versions through commit 82821f7) allows an attacker who c
cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488). Rated critical severit
In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554). Rated critical severit
In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549). Rated critical severit
chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497). Rated critical severity (CVSS 9.8), this vulnerability
cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution (SEC-485). Rated critical severit
cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs (SEC-546). Rated critical s
cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell (SEC-544). Rated c
Exploit-DB