Loading vulnerability…
Root Privilege Escalation in cPanel CalDAV/CardDAV
CVE-2026-87899 is an execution-with-unnecessary-privileges vulnerability in cPanel & WHM CalDAV/CardDAV functionality. An authenticated cPanel account holder can exploit the flaw to escalate privileges and execute arbitrary code in the root security context. The issue affects cPanel & WHM version 120 and later in vulnerable release builds.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation gives a low-privileged authenticated cPanel user arbitrary code execution as root, enabling complete compromise of the affected server. In shared-hosting environments, compromise of a single tenant account can therefore compromise the host and other tenants, with high confidentiality, integrity, and availability impact.
If you can’t patch tonight, do this now.
No vendor-provided temporary workaround is available for the vulnerable CalDAV/CardDAV functionality. Until patching is complete, restrict cPanel access to trusted users and networks, minimize the number of active cPanel accounts, and monitor CalDAV/CardDAV and privileged activity for anomalous behavior. Prioritize remediation on internet-facing and multi-tenant hosting systems.
Patch, then assume compromise.
Upgrade cPanel & WHM to the applicable fixed release: 11.134.0.57 or later, 11.136.0.41 or later, or 11.138.0.8 or later. For WP Squared deployments, upgrade to 11.138.1.11 or later. Verify the installed version after updating.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.