widely-deployed-product-advisoryprivilege-escalation-methodinternet-facing-service-vulnerability

Critical cPanel Flaw Lets Authenticated Users Gain Database Root Privileges

Patch & Detection Intelligence · 4 sources · Updated 3mo ago · First seen Aug 4, 2026

cPanel disclosed and patched CVE-2026-58048, a critical privilege-escalation flaw in cPanel & WHM that allows an authenticated user with MySQL or MariaDB access to execute arbitrary SQL commands with full database administrator privileges. The bug, rated CVSS 9.4, affects all supported cPanel & WHM versions and WP Squared, and stems from the database rename process failing to preserve SQL mode correctly, enabling escalation into the database root context.

The company warned that in some shared-hosting, database, and operating-system configurations, the flaw could extend beyond database control to OS-level compromise and potentially full server takeover. cPanel said customers should upgrade immediately to fixed releases; if patching is delayed, administrators should temporarily revoke the MySQL feature from cPanel users and review database audit logs for suspicious administrative activity. CISA said no active exploitation had been observed and classified the issue as non-automatable despite its severe technical impact.

Patch this, or something else?See real exploitation activity before you spend the cycle.

Triage this advisory

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

3 events · Aug 4, 2026

Reported Aug 4, 20263mo ago
cPanel released patches for CVE-2026-58048
cPanel released fixed builds for all supported cPanel & WHM versions and WP Squared/WP2 deployments, including 11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48, 11.136.0.32, and 138.1.6. The flaw allows an authenticated user with MySQL or MariaDB access to execute arbitrary SQL commands with full database administrative privileges.
Critical cPanel Vulnerability Allows Execution of SQL Commands as Root User
Reported Aug 4, 20263mo ago
Vincent55 Yang responsibly reported CVE-2026-58048 to cPanel
WebPros credited security researcher Vincent55 Yang with responsibly reporting the cPanel & WHM privilege-escalation flaw CVE-2026-58048. The references do not provide a date for when the report was made.
Critical cPanel Vulnerability Allows Execution of SQL Commands as Root User
Aug 4, 20263mo ago
CISA reported no observed exploitation of CVE-2026-58048
On August 4, CISA listed CVE-2026-58048 with no observed exploitation, classified it as non-automatable, and rated its technical impact as total. This status update accompanied public reporting on the newly disclosed cPanel vulnerability.
CVE-2026-58048: cPanel Bug Enables Full Database Administrator Access

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Database privilege escalation in cPanel & WHM (CVE-2026-58048)

Affected products

3 linked

Wp SquaredCpanel & WhmCpanel

Organizations

1 linked

Cpanel

Do you run this?See real exploitation activity behind this advisory so you can triage it against everything else in the queue.

Prioritize This Patch

Source coverage

Sources

4 references tracked. Mallory keeps watching after this page renders.

UnclassifiedNews · Aug 4, 2026

So What's Up With That New cPanel Database Vulnerability? - LowEndBoxOpen source ↗

Ca CcsNews · Aug 4, 2026

WebPros security advisory (AV26-772) - Canadian Centre for Cyber SecurityOpen source ↗

Security AffairsNews · Aug 4, 2026

CVE-2026-58048: cPanel Bug Enables Full Database Administrator AccessOpen source ↗

Cyber Security NewsNews · Aug 4, 2026

Critical cPanel Vulnerability Allows Execution of SQL Commands as Root UserOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Critical cPanel Flaw Lets Authenticated Users Gain Database Root Privileges

How this story unfolded

cPanel released patches for CVE-2026-58048

Vincent55 Yang responsibly reported CVE-2026-58048 to cPanel

CISA reported no observed exploitation of CVE-2026-58048

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Critical cPanel & WHM Auth Bypass Exploited for Server Takeover

Critical cPanel Flaw Lets Hosting Users Escalate to Root Server Control

cPanel Authentication Bypass and New RCE Flaws Put Hosting Servers at Risk

Critical cPanel Flaw Lets Authenticated Users Gain Database Root Privileges

How this story unfolded

cPanel released patches for CVE-2026-58048

Vincent55 Yang responsibly reported CVE-2026-58048 to cPanel

CISA reported no observed exploitation of CVE-2026-58048

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Critical cPanel & WHM Auth Bypass Exploited for Server Takeover

Critical cPanel Flaw Lets Hosting Users Escalate to Root Server Control

cPanel Authentication Bypass and New RCE Flaws Put Hosting Servers at Risk