Privilege Escalation in cPanel Affects Remote Authenticated Users
CVE-2026-87899

9.4CRITICAL

Key Information:

Vendor

Webpros

Status
Cpanel
Vendor
CVE Published:
23 September 2026

Badges

📈 Trended📈 Score: 3,350📰 News Worthy

What is CVE-2026-87899?

CVE-2026-87899 is a serious privilege escalation vulnerability found in cPanel, a popular web hosting control panel that provides a graphical interface and automation tools to simplify the process of hosting a website. This specific vulnerability allows remote authenticated users to execute arbitrary code with root privileges, bypassing normal access controls. Such a flaw could severely compromise the integrity and security of servers managed through cPanel, potentially leading to unauthorized system access, data manipulation, and control over hosted applications. The ability for authenticated users to escalate their privileges to root access represents a critical risk, as it could enable significant malicious actions within the affected environments.

Potential impact of CVE-2026-87899

  1. Unauthorized Access and Control: The vulnerability may allow attackers with valid authentication credentials to gain root-level access. This elevated privileges can facilitate a wide range of malicious activities, including data theft, alteration of files, and the deployment of additional malware on the server.

  2. Data Breaches: With the capability to execute arbitrary code, attackers could access sensitive data stored on the server, potentially leading to data breaches that compromise user information and violate regulatory compliance.

  3. Service Disruption: Exploitation of this vulnerability could result in the disruption of hosting services, as attackers may manipulate system operations, deploy denial-of-service attacks, or use the compromised server for further attacks on the network, impacting business continuity and reliability.

Affected Version(s)

cPanel 11.120.0.0 < 11.134.0.57

cPanel 11.136.0.0 < 11.136.0.41

cPanel 11.138.0.0 < 11.138.0.8

News Articles

favicon imageThe Hacker News

New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server Control

cPanel fixed three flaws, including one that lets any logged-in cPanel account run code as root and another that can modify other accounts' databases.

3 weeks ago

References

https://support.cpanel.net/hc/en-us/articles/43591715125271

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 📈

    Vulnerability started trending

  • 📰

    First article discovered by The Hacker News

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ali Mustafa (rz1027)
.