{"id":1941,"date":"2026-09-24T12:05:41","date_gmt":"2026-09-24T06:35:41","guid":{"rendered":"https:\/\/www.hexnode.com\/threat-watch\/?p=1941"},"modified":"2026-09-25T10:20:50","modified_gmt":"2026-09-25T04:50:50","slug":"cpanel-cve-2026-87899-root-server-control","status":"publish","type":"post","link":"https:\/\/www.hexnode.com\/threat-watch\/cpanel-cve-2026-87899-root-server-control\/","title":{"rendered":"cPanel CVE-2026-87899: Root Code Execution and Shared Hosting Risk"},"content":{"rendered":"

Sharing a hosting server should not mean sharing access to another company\u2019s systems. On September 22, 2026, cPanel disclosed cPanel CVE-2026-87899, which lets an authenticated account escalate privileges through its calendar and contact functionality.<\/p>\n

Successful exploitation can give an attacker server-wide control. The disclosure therefore matters to hosting providers, MSPs, and businesses that rely on hosted websites and applications.<\/p>\n

The immediate priority is confirming updates. However, teams should also understand the separate database and data-access flaws disclosed alongside it.<\/p>\n \t\t

\r\n \t\t\tWho is cPanel?<\/span> \t\t\t \t\t\t\t

\r\n \t\t\t\t\tcPanel provides web hosting management software. Its cPanel interface lets account holders manage resources such as websites, email, files, and databases. WebHost Manager, or WHM, provides administrative functions for managing hosting accounts and servers.<\/p>\n

In shared hosting, multiple customers use resources on the same underlying server. Account permissions help separate their environments, while server administrators hold broader privileges. That distinction makes vulnerabilities crossing account boundaries particularly important.<\/p>\n

WP Toolkit adds WordPress management capabilities to this environment. CalDAV and CardDAV support calendar and contact functions. The disclosures concern these hosting components; they do not identify a named threat group. Hosting providers generally handle server updates, while customers should verify remediation with their provider. \t\t\t\t<\/p>\r\n \t\t\t \t\t\t\r\n \t\t<\/div>\r\n \t\t\n

What happened?<\/h2>\n

The September 22 disclosures describe three distinct vulnerabilities. They should not be treated as a confirmed multi-stage attack chain.<\/p>\n\n\n\n\n\n\n\n
Vulnerability<\/th>\nRequired access<\/th>\nDisclosed impact<\/th>\nAffected versions<\/th>\n<\/tr>\n<\/thead>\n
CVE-2026-87899<\/td>\nAuthenticated cPanel account<\/td>\nCode execution as root through CalDAV\/CardDAV<\/td>\ncPanel & WHM v120 onward, before the applicable fix<\/td>\n<\/tr>\n
WP Toolkit CVE-2026-87900<\/td>\nAuthenticated cPanel user<\/td>\nDatabase modifications in other accounts<\/td>\nWP Toolkit 6.11.2-10794 and earlier<\/td>\n<\/tr>\n
CVE-2026-68490<\/td>\nLocal user on the same server<\/td>\nReading other accounts\u2019 calendar events and contacts<\/td>\ncPanel & WHM v120 onward, before the applicable fix<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The calendar permissions flaw does not grant root access or permission to modify the exposed data. Its update corrects permissions for new storage and repairs existing accounts.
\n

<\/div>

Top 7 Features to Look for in an MSP-Ready UEM Platform<\/h4>

Explore seven essential features of an MSP-ready UEM platform for secure, scalable client management.<\/p><\/div><\/div><\/div><\/a><\/div><\/div><\/div><\/p>\n

Which versions contain fixes?<\/h3>\n

For the two CalDAV\/CardDAV issues, patched builds include 134.0.57<\/strong>, 136.0.41<\/strong>, and 138.0.8<\/strong>, or later builds in their respective release lines. The listed WP Squared fix is 138.1.11<\/strong> or later. These versions omit the leading \u201c11.\u201d used in the advisories.<\/p>\n

For WP Toolkit, update to 6.11.3 or later<\/strong>. Check its installed version separately rather than assuming the main control-panel update covers it.<\/p>\n

The advisories direct administrators to update and do not document a temporary workaround.<\/p>\n

What remains uncertain?<\/h3>\n

The advisories do not identify an attacker, victim organization, initial credential-theft method, persistence technique, or ransomware activity. They also do not establish active exploitation.<\/p>\n

An attacker could potentially use a compromised hosting account, but credential theft is not a confirmed part of these disclosures. A malicious account holder could also satisfy the authentication requirement. No MFA bypass should be inferred.<\/p>\n

Why this matters<\/h2>\n

Shared hosting security depends on keeping one customer\u2019s permissions separate from another\u2019s. A privilege-escalation flaw can undermine that separation even when the affected business maintains its own website carefully.<\/p>\n

Potential consequences include unauthorized changes, exposure of server-accessible secrets, and disruption across hosted services. These are possible outcomes, not confirmed losses from this disclosure.<\/p>\n

MFA can reduce some account-takeover risks, but it cannot repair a vulnerability available to an authenticated user. Similarly, securing an administrator\u2019s laptop does not remove a flaw inside the hosting platform.<\/p>\n

Effective MSP security therefore needs several layers: verified server updates, limited administrative access, protected administrator devices, and an investigation process. Where evidence suggests web hosting compromise, responders should assess the server and neighboring accounts rather than checking only one website.
\n

\n
\n
\n
\n \"Hexnode-IDP_Usecases\"\n <\/div>\n <\/div>\n
\n
\n Featured Resource\n <\/h5>\n

\n Hexnode IdP use cases\n <\/h4>\n

\n Check out this document for a quick glance into Hexnode IdP's capabilities.\n <\/p>\n \n Get the infographic\n \n \n \n \n <\/g>\n <\/svg>\n\n <\/a>\n <\/div>\n <\/div>\n <\/section><\/p>\n

How Hexnode can help<\/h2>\n

Hexnode can strengthen administrator endpoints and support response to related endpoint threats. Remediation of the hosting vulnerabilities remains a server-management responsibility.<\/p>\n

Hexnode UEM: Check administrator-device compliance<\/h3>\n

Hexnode UEM<\/a> supports configurable compliance checks, including supported operating-system, encryption, and application criteria. Teams can use these checks to identify administrator devices that fall outside their security requirements.
\nApply suitable policies to devices used for hosting administration and investigate compliance failures. This helps maintain the surrounding administrative environment, but device compliance does not verify a cPanel patch or prevent a malicious hosting customer from exploiting an unpatched server.<\/p>\n

Hexnode UEM: Support device-aware access decisions<\/h3>\n

Hexnode\u2019s Microsoft Entra Conditional Access integration lets supported device-compliance information inform access policies for integrated resources. Microsoft Entra enforces the configured access decision.<\/p>\n

By default, cPanel\/WHM authenticates users through local accounts on the Linux hosting server. Hexnode UEM\u2019s integration does not automatically extend Conditional Access to these native logins. Access to the management console must pass through Microsoft Entra authentication\u2014for example, through Entra Application Proxy with Entra preauthentication or a supported, configured federated single sign-on (SSO) integration. Direct login paths must also be restricted to prevent users from bypassing that access policy.<\/p>\n

Use this where the administrative resource, device platform, and integration support the intended policy. Do not assume this automatically protects direct cPanel or WHM logins. Validate the access path and relevant licensing before relying on compliance-gated access.<\/p>\n

Hexnode XDR: Investigate and contain affected endpoints<\/h3>\n

Hexnode XDR<\/a> secures Windows and macOS administrator workstations, helping teams investigate signs of credential theft or endpoint malware. Its role here is to protect those workstations, rather than operate on the Linux hosting server itself. It supports endpoint investigation and response actions, including device isolation and process termination. These capabilities can help when an investigation finds malicious processes or other supported threat signals on an administrator endpoint.<\/p>\n

An XDR investigation can complement server-side analysis if evidence links endpoint activity to the incident. However, endpoint telemetry alone cannot confirm whether someone exploited the cPanel service. Server logs, account activity, and forensic evidence remain necessary.<\/p>\n

What security teams should do next<\/h2>\n

Treat cPanel root code execution as a server-remediation priority. An update closes the vulnerability, but it does not establish whether earlier compromise occurred.<\/p>\n

    \n
  1. Verify installed versions.<\/strong> Inventory affected servers, apply the correct patched build, and check WP Toolkit separately. Shared-hosting customers should request confirmation from their provider.<\/li>\n
  2. Review access.<\/strong> Remove unnecessary accounts and privileges. Restrict administrative routes and enforce appropriate authentication controls.<\/li>\n
  3. Investigate suspicious activity.<\/strong> Preserve logs and examine unexplained privileged actions, cross-account changes, unfamiliar scheduled tasks, and unauthorized access keys. These are investigation leads, not published indicators specific to these flaws.<\/li>\n
  4. Respond to confirmed exposure.<\/strong> Contain affected systems and rotate exposed credentials or keys from trusted devices. Follow incident-response procedures if server integrity is uncertain.<\/li>\n
  5. Strengthen administrator endpoints.<\/strong> Apply suitable compliance requirements through Hexnode UEM and use Hexnode XDR for relevant endpoint investigation and containment.<\/li>\n<\/ol>\n

    Close remediation only after verifying updates and resolving suspicious findings.
    \n

    <\/div><\/div>
    Try\u202fHexnode\u202fFree for 14 Days\u202f\u202f\u202f<\/h5>

    Sign up for Hexnode to strengthen administrator-device compliance and support endpoint threat response.<\/p>