cPanel EUVD-2026-51573

Exploitation requires an authenticated low-privileged cPanel account (PR:L) with access to the database-management interface, and specifically invokes the database-rename operation, where the active SQL mode is not preserved and injected SQL is executed in the root database context. No end-user interaction is needed (UI:N) and the vector is network-reachable (AV:N). The principal limiting factor is that the attacker must already possess a valid hosting account on the target server, so the realistic exposure is malicious or compromised tenants in shared/multi-tenant cPanel and WP Squared deployments rather than fully anonymous internet attackers.

The signals point to a genuine high-priority issue for multi-tenant hosting environments. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack needing only low privileges and no user interaction, with high confidentiality, integrity and availability impact on both the vulnerable system and subsequent systems (SC:H/SI:H/SA:H) - consistent with a tenant escaping into the root database context. EPSS and KEV data were not provided, so exploitation probability and active-exploitation status are unknown; there is no public exploit identified at time of analysis, so this is not confirmed as actively exploited. The primary caveat is that PR:L means an attacker must already hold a valid cPanel account, which limits exposure to shared-hosting operators and their tenants rather than the open internet, but in a shared-hosting threat model a malicious or compromised tenant reaching root SQL context is a severe, realistic outcome.

A malicious customer on a shared cPanel server logs into their standard hosting account and triggers a database-rename operation crafted to abuse the unpreserved SQL mode. Because the rename executes in the root database context, the injected SQL runs with full server privileges, letting the tenant read, modify, or destroy other customers' databases or escalate control of the database server. No public exploit code has been identified at time of analysis, and the attack requires only low-privileged authenticated access with no user interaction.