internet-facing-service-vulnerabilityprivilege-escalation-methodwidely-deployed-product-advisory

cPanel Flaws Let Hosting Users Gain Root and Access Other Tenants

Vulnerability Disclosure · 6 sources · Updated 1mo ago · First seen Sep 23, 2026

cPanel released fixes for three vulnerabilities that break tenant isolation on shared-hosting servers. CVE-2026-87899 allows an authenticated cPanel account holder to escalate privileges and execute code as root, potentially taking control of the entire host; CVE-2026-68490 exposes other accounts’ CalDAV/CardDAV calendar events and contacts through incorrect permissions. Both affect cPanel & WHM version 120 and later.

A separate WP Toolkit vulnerability, CVE-2026-87900, enables a logged-in cPanel user to modify databases belonging to other cPanel accounts. cPanel has issued fixed builds, but no temporary mitigations were provided for the CalDAV/CardDAV issues and no exploitation has been reported. Administrators should urgently update cPanel/WHM and WP Toolkit, particularly on public multi-tenant deployments, and investigate anomalous cross-account access or database changes.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

5 events · Sep 22, 2026 – Sep 24, 2026

Sep 24, 20261mo ago
Canadian Cyber Centre discloses Plesk root code-execution flaws
On September 24, 2026, the Canadian Centre for Cyber Security published advisory AV26-961 identifying CVE-2026-68492 in the Plesk RESTful API extension and CVE-2026-87898 in Site Import, which can enable arbitrary code execution as root. The advisory identified affected Plesk versions and urged administrators to apply available updates.
WebPros security advisory (AV26-961) - Canadian Centre for Cyber Security
Sep 23, 20262mo ago
CVE record details WP Toolkit argument injection and cross-account code execution
The CVE-2026-87900 record identified the WP Toolkit issue as CWE-88 argument injection affecting version 6.11.2-10794 and earlier. It states that authenticated remote attackers can read arbitrary files and execute arbitrary code across customer accounts.
CVE-2026-87900 - WP Toolkit for cPanel Argument Injection
Sep 22, 20262mo ago
cPanel patches WP Toolkit cross-account database modification flaw
On September 22, 2026, cPanel patched CVE-2026-87900 in WP Toolkit, which enables a logged-in cPanel user to modify databases belonging to other accounts. The flaw affects WP Toolkit 6.11.2-10794 and earlier and is remediated in version 6.11.3 or later.
New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server Control
Sep 22, 20262mo ago
cPanel patches cross-account CalDAV/CardDAV data exposure
On September 22, 2026, cPanel released a fix for CVE-2026-68490, an incorrect-permissions flaw allowing a local server user to read other accounts' calendar events and contacts. The vulnerability affects cPanel & WHM 120 and later but does not permit data modification or root access.
New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server Control
Sep 22, 20262mo ago
cPanel discloses and patches CalDAV/CardDAV root escalation flaw
On September 22, 2026, cPanel disclosed CVE-2026-87899, which lets an authenticated cPanel account holder execute code as root through CalDAV/CardDAV. The issue affects cPanel & WHM 120 and later and was fixed in specified 11.134, 11.136, 11.138, and WP Squared builds.
New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server Control

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

3 linked

Cross-account CalDAV/CardDAV information disclosure in cPanel & WHM (CVE-2026-68490)Root Privilege Escalation in cPanel CalDAV/CardDAV (CVE-2026-87899)Argument injection in WP Toolkit for cPanel (CVE-2026-87900)

Affected products

4 linked

CpanelCpanel & WhmCpanel And WhmWp Toolkit

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

6 references tracked. Mallory keeps watching after this page renders.

Ca CcsNews · Sep 24, 2026

WebPros security advisory (AV26-961) - Canadian Centre for Cyber SecurityOpen source ↗

Cvefeed High SeverityAdvisories · Sep 23, 2026

CVE-2026-87899 - cPanel Arbitrary Code Execution via Privilege EscalationOpen source ↗

Cvefeed High SeverityAdvisories · Sep 23, 2026

CVE-2026-87900 - WP Toolkit for cPanel Argument InjectionOpen source ↗

Cvefeed High SeverityAdvisories · Sep 23, 2026

CVE-2026-68490 - CalDAV/CardDAV Improper Access ControlOpen source ↗

Cyber Security NewsNews · Sep 23, 2026

New Cpanel Vulnerability Allows Attackers to Access Other Users' AccountsOpen source ↗

The Hacker NewsNews · Sep 23, 2026

New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server ControlOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

cPanel Flaws Let Hosting Users Gain Root and Access Other Tenants

How this story unfolded

Canadian Cyber Centre discloses Plesk root code-execution flaws

CVE record details WP Toolkit argument injection and cross-account code execution

cPanel patches WP Toolkit cross-account database modification flaw

cPanel patches cross-account CalDAV/CardDAV data exposure

cPanel discloses and patches CalDAV/CardDAV root escalation flaw

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

cPanel Authentication Bypass and New RCE Flaws Put Hosting Servers at Risk

Critical cPanel Flaw Lets Hosting Users Escalate to Root Server Control

Critical cPanel & WHM Auth Bypass Exploited for Server Takeover

cPanel Flaws Let Hosting Users Gain Root and Access Other Tenants

How this story unfolded

Canadian Cyber Centre discloses Plesk root code-execution flaws

CVE record details WP Toolkit argument injection and cross-account code execution

cPanel patches WP Toolkit cross-account database modification flaw

cPanel patches cross-account CalDAV/CardDAV data exposure

cPanel discloses and patches CalDAV/CardDAV root escalation flaw

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

cPanel Authentication Bypass and New RCE Flaws Put Hosting Servers at Risk

Critical cPanel Flaw Lets Hosting Users Escalate to Root Server Control

Critical cPanel & WHM Auth Bypass Exploited for Server Takeover