cPanel Nova Plugin EUVD-2026-28812

Exploitation requires a valid, authenticated cPanel user account - standard shared hosting credentials suffice and no administrative privileges are needed. The attacker must be able to write to their home directory via any supported channel (SSH, SFTP, FTP, or the cPanel web file manager). The critical prerequisite is the existence of a user-accessible 'legacy Nova path' under the home directory that the Cpanel::Nova::Connector processes with root privileges: the attacker must replace or create this path as a symbolic link before the privileged chmod executes. The Nova plugin must be installed and active on the server. Exploitation is limited by: the requirement for a pre-existing cPanel account, the Nova plugin being present and processing the user's path, and the non-automatable nature of the symlink placement timing. Users without any home directory write access (e.g., FTP-disabled, read-only jailed accounts) cannot exploit this flaw.

The vendor-provided CVSS 4.0 score of 5.3 with AV:N appears inconsistent with the attack mechanism: placing a symlink in a home directory is a local filesystem operation, suggesting AV:L is more appropriate - a discrepancy that should be verified against the vendor advisory. SSVC rates Technical Impact as total, which better reflects real-world severity given that successful exploitation yields root-level permission control over arbitrary system files. EPSS at 0.04% (13th percentile) and SSVC Exploitation: none are aligned, indicating no observed in-the-wild activity and no public exploit code at time of analysis. The Automatable: no SSVC rating confirms mass exploitation is not feasible due to the requirement for a valid cPanel account and placement of the symlink prior to a privileged operation. The genuine risk is concentrated in multi-tenant shared hosting environments, where any of potentially thousands of cPanel users could leverage this to escalate against the underlying server - a significant concern for hosting providers, but not an opportunistic internet-scale threat.

An authenticated cPanel user with file manager or SFTP access replaces the legacy Nova path in their home directory with a symbolic link pointing to a privileged system file such as /etc/passwd or /etc/sudoers. When the cPanel Nova plugin's Connector subsequently runs its scheduled or triggered chmod as root, it follows the symlink and sets world-writable or attacker-chosen permissions on the target system file. The attacker then modifies the now-writable system file to add a privileged entry, achieving local privilege escalation to root - or alternatively targets a critical service file to trigger a denial of service affecting all tenants on the host.