cPanel WHM CVE-2026-105476

Exploitation requires an authenticated cPanel/WHM account (CVSS PR:L) that is remotely reachable over the network, so the attacker must already possess valid low-privilege panel credentials - typically a hosting customer, reseller, or compromised account - which limits this to entities with existing access rather than anonymous internet attackers. The flaw is an improper link resolution before file access (CWE-59, symlink-style) that lets a privileged operation write an arbitrary root-owned file; the exact feature or operation that performs the vulnerable write is not described in the available sources. Limiting factors: valid authentication is mandatory and the server must run an unpatched cPanel build below the fixed versions (11.138.0.19, 11.136.0.51, 11.134.0.67, or 11.110.0.154 for their respective branches); no user interaction is needed once authenticated.

This is a genuine but not emergency-level priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High) indicates a network-reachable, low-complexity flaw requiring only low privileges (PR:L) and no user interaction, yielding total confidentiality, integrity and availability impact - consistent with an authenticated cPanel user writing arbitrary root-owned files to escalate to root. The decision signals temper the raw score: SSVC reports Exploitation 'none' and Automatable 'no' (while Technical Impact is 'total'), and the vuln.today Decision label is 'this_week' rather than act_now or emergency. There is no CISA KEV listing and no EPSS score was supplied, so widespread or automated exploitation is not currently indicated. No confirmed working public exploit is present (the vuldb and NVD entries are advisory references, not exploit code). The main caveat: the input provides no EPSS probability, so likelihood of exploitation in the wild cannot be quantified from this data and rests on the SSVC 'none' exploitation status alone.

A customer or reseller who already holds a valid, low-privilege cPanel/WHM account authenticates to the panel and abuses the improper link resolution (symlink/CWE-59) flaw to make a privileged operation write an attacker-controlled file to a root-owned location. By placing or overwriting a root-owned file, the attacker escalates from their restricted account to full root control of the shared hosting server. No public exploit code is identified at time of analysis, and no user interaction is required.