EUVD-2026-85622
GHSA-9m4j-95hw-qv52
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged cPanel account
-
DeliverySend crafted authenticated request
-
ExploitInvoke over-privileged root operation
-
ExecutionExecute arbitrary code as root
-
ImpactCompromise entire shared host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V8 - Authorization Unnecessary privilege execution
|
| Exploitation Conditions | Requires a valid low-privileged cPanel account (PR:L) reachable over the network; the specific vulnerable feature/endpoint is not named in the description beyond the CWE-250 pattern of a privileged operation executed with unnecessary root privileges. No user interaction, no special client configuration, and low attack complexity are needed once authenticated. The primary limiting factor is possession of any authenticated cPanel account - trivial on shared-hosting environments where accounts are sold, but a real barrier on locked-down single-tenant deployments. Exact affected version ranges and the required deployment mode are not specified in the provided data (vendor KB content not captured). |
| Impact | This is a genuine high-priority issue, not a high-CVSS-but-low-real-risk case. The vendor CVSS 4.0 vector (9.4) is internally consistent with the description: AV:N/AC:L/AT:N/PR:L/UI:N with full VC:H/VI:H/VA:H and subsequent-system SC:H/SI:H/SA:H reflects a low-privileged remote authenticated user escalating to arbitrary code execution as root (CWE-250, execution with unnecessary privileges). The network vector, low complexity, no user interaction, and only PR:L (any cPanel account) make this readily exploitable once an attacker holds any hosting account - a common condition on shared-hosting boxes where accounts are cheaply obtained. The SC/SI/SA:H subsequent-system impacts correctly capture the crossing of a security boundary (unprivileged account context to full root/host compromise), meaning one compromised account can take over the entire multi-tenant server. Counterbalancing signals: no EPSS score, no CISA KEV listing, and no public exploit are present in the data, so there is no evidence of active or automated exploitation yet - this is a severity-driven priority, not an exploitation-driven emergency. The single reference is a support.cpanel.net KB article (title/content not captured, marked None), so patch details and affected version ranges are not confirmed from the provided data. |
| Exploit ScenarioDerived | An attacker purchases or compromises any low-privileged cPanel hosting account on a shared server, then invokes the vulnerable functionality over the network which performs a privileged operation as root without adequate privilege dropping, resulting in arbitrary code execution as root and full takeover of the multi-tenant host. No user interaction is required and attack complexity is low. No public proof-of-concept is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Any holder of a valid low-privileged cPanel account can escalate to root and execute arbitrary code on the underlying host, because a privileged cPanel operation is executed with unnecessary root privileges (CWE-250). The flaw is remotely reachable over the network with low attack complexity and no user interaction, but it does require an authenticated account (CVSS 4.0 vector PR:L) - a trivial barrier on shared hosting where accounts are commonly sold or self-provisioned, and a meaningful one on locked-down single-tenant deployments. It carries a 9.4 CVSS 4.0 score and is rated a genuine high-priority issue rather than a high-score/low-real-risk case, though no public exploit code and no confirmed active exploitation were identified at time of analysis; no EPSS estimate was available in the supplied intelligence.
RemediationAI
Apply the fixed cPanel & WHM release documented in the vendor advisory at https://support.cpanel.net/hc/en-us/articles/43591715125271 and upgrade as soon as possible; no exact patched version number is captured in the available intelligence, so the advisory must be consulted directly for the specific build to install - no vendor-released patch version can be confirmed from the data at time of analysis. Where immediate patching is not possible, the highest-leverage compensating control is to shrink the population that can satisfy the PR:L authentication prerequisite: disable or tightly gate self-service and reseller account creation, suspend dormant or unused accounts, and enforce strong authentication (including two-factor) on every cPanel login so a compromised or purchased account cannot be used as the escalation foothold - the trade-off is reduced customer self-service and additional support overhead. Because the vulnerable feature is not named in the available data, endpoint-level blocking at a WAF or reverse proxy is not actionable without first identifying the specific cPanel request path from vendor guidance; if the vendor identifies the affected endpoint, blocking unprivileged access to it is preferable to blocking the full control panel, which would break legitimate hosting administration. Detection and containment options include monitoring for unexpected child processes spawned as root by cPanel backend services and for anomalous process trees originating from unprivileged accounts, plus network-segmenting shared-hosting nodes so one compromised tenant cannot reach other hosts - noting that neither detects nor prevents the initial escalation and both add operational cost. Given the impact is full root compromise of a multi-tenant node, treating this as an emergency maintenance item and rebuilding any host with evidence of prior escalation is warranted.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
cPanel & WHM is a web hosting control panel whose architecture deliberately splits unprivileged per-account tooling from privileged, root-owned backend services (for example the cpsrvd daemon and root-run helper binaries) that carry out administrative actions such as account management, package changes, and service operations. CWE-250 (Execution with Unnecessary Privileges) is the root-cause class here: a code path that only needs the requesting account's privileges instead runs inside a root context, so a low-privileged user can influence what that privileged code path executes. Because the privileged component is reachable through the network-facing control panel, the weakness converts an ordinary authenticated hosting account into arbitrary code execution as root, breaking the tenant isolation boundary that shared hosting depends on. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) and the independent assessment's CVSS 3.1 vector (S:C, C/I/A:H) both agree that confidentiality, integrity, and availability impacts extend beyond the vulnerable component itself - consistent with full host compromise rather than a confined per-account breach. The supplied intelligence does not name the specific vulnerable endpoint, function, or parameter, so the exact privileged code path is not confirmed from available data.
Know when Cpanel gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Remote low-priv authenticated user (PR:L) executes code as root, crossing the account-to-host boundary (S:C) with full C/I/A loss; low complexity, no interaction.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
2DescriptionCVE.org
Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges.
Executive ViewAI
cPanel, a widely used web hosting control panel, contains a critical privilege escalation flaw (CVE-2026-87899, CVSS 9.4) that allows any authenticated low-privileged account holder to gain root-level code execution on the underlying host. This poses severe risk to shared hosting environments, where accounts are often self-provisioned or resold, potentially leading to full server compromise, cross-tenant data exposure, and service disruption. No public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis, making this a high-priority issue for security leadership.
No vendor-released patch identified at time of analysis; interim mitigations include restricting network access to cPanel/WHM management interfaces, enforcing MFA for all accounts, auditing and disabling unused low-privileged accounts, enabling detailed logging and monitoring for privilege escalation, and applying least-privilege configurations via available cPanel settings.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Root-level remote code execution in WebPros cPanel is achievable by any mail-enabled account through a SQL injection fla
An issue was discovered in cPanel before 11.109.9999.116. Rated medium severity (CVSS 6.1), this vulnerability is remote
cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is
OS command injection in cPanel and WP Squared allows an authenticated, low-privileged hosting account holder to execute
cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488). Rated critical severit
In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554). Rated critical severit
In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549). Rated critical severit
chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497). Rated critical severity (CVSS 9.8), this vulnerability
cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution (SEC-485). Rated critical severit
cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs (SEC-546). Rated critical s
cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell (SEC-544). Rated c
Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows a remote authenticated (low-privileged, PR:L
Exploit-DB