As reported by The Hacker News, cPanel disclosed three vulnerabilities on September 22, 2026 — and the most severe one shatters the foundational security model of shared hosting. CVE-2026-87899 allows any authenticated cPanel account holder to execute code as root, achieving full server takeover. This is not a privilege escalation that requires special access or a misconfiguration — it works with a basic hosting account.
Why This Matters More Than a Typical CVE
Shared hosting providers sell cPanel accounts to untrusted, mutually anonymous customers on the same physical server. The entire business model depends on account isolation: one tenant cannot see, modify, or control another tenant's files, databases, or processes. CVE-2026-87899 collapses that boundary entirely. Any paying customer — or anyone who compromises a customer's credentials via phishing, credential stuffing, or stealer malware — can pivot to root and own every account on the box, including the provider's WHM administrative layer.
This is the shared-hosting equivalent of a container escape in cloud infrastructure. The blast radius extends well beyond the initial account: every website, database, email store, SSL private key, and customer credential on the server becomes accessible. For budget hosting providers running dense multi-tenant servers with hundreds or thousands of accounts per box, a single exploitation event could cascade into mass data theft and persistent backdooring.
The attacker doesn't need a zero-day or a sophisticated exploit chain. They need a $5/month hosting account — or stolen credentials for one.
Vulnerability Summary
| CVE | Component | Impact | Severity | Affected | Fixed In |
|---|---|---|---|---|---|
| CVE-2026-87899 | CalDAV/CardDAV | Authenticated account holder → root RCE | Critical | cPanel & WHM v120+; WP Squared | 11.134.0.57+, 11.136.0.41+, 11.138.0.8+, WP Squared 11.138.1.11+ |
| CVE-2026-87900 | WP Toolkit plugin | Cross-account database modification | High | WP Toolkit ≤ 6.11.2-10794 | WP Toolkit 6.11.3+ |
| CVE-2026-68490 | CalDAV/CardDAV | Local user reads other accounts' contacts/calendars | Medium | cPanel & WHM v120+; WP Squared | Same as CVE-2026-87899 |
Active exploitation: None publicly confirmed. Not listed in CISA's KEV catalog as of September 23, 2026. However, cPanel has provided no detection guidance or IOCs, leaving defenders blind to pre-patch exploitation.
The WP Toolkit Blind Spot
CVE-2026-87900 is less catastrophic but equally concerning for data integrity. The WP Toolkit plugin, used to manage WordPress installations, allows an authenticated cPanel user to modify databases belonging to other accounts. cPanel's advisory is vague on scope — it doesn't clarify whether data exfiltration is possible, whether WP Toolkit access is required, or what specific modifications are feasible. This ambiguity is a defender's nightmare: you cannot build detection rules or assess impact without knowing the attack surface.
Notably, WP Toolkit is also available for Plesk, another WebPros product. cPanel has not addressed whether the Plesk version shares the same vulnerability. Organizations running Plesk should treat this as potentially affected until confirmed otherwise.
A Pattern Worth Watching
Researcher Ali Mustafa (rz1027) has been credited with at least seven cPanel and Plesk vulnerabilities since August 27, 2026 — including a September 8 root escalation via the EmailTrack feature. This concentration suggests a systematic audit of cPanel's privileged service handlers, and it's likely more findings will emerge. Hosting providers should treat cPanel's CalDAV, CardDAV, email, and plugin subsystems as high-risk attack surfaces and budget for rapid patching cadences through at least Q4 2026.
Who Is Most at Risk
Shield53 Recommendations
Immediate Actions
- Patch NOW. Update to 11.138.0.8 or later (or 11.136.0.41 / 11.134.0.57 if on those release tiers). For WP Squared, update to 11.138.1.11+. Update WP Toolkit to 6.11.3+.
- Disable CalDAV/CardDAV if patching cannot be completed immediately. In WHM, navigate to Service Configuration → CalDAV/CardDAV and disable the service. This is a temporary mitigation only.
- Audit account creation logs for suspicious new signups in the 30 days prior to patching — attackers may have planted accounts in advance.
- Review root-level process execution logs and check for unexpected cron jobs, SUID binaries, or new SSH authorized_keys entries on all shared servers.
- Force password resets for all cPanel accounts if you suspect any pre-patch exploitation, since credentials may have been harvested from compromised servers.
Hardening & Ongoing Defense
- Enable cPanel's mod_security and configure rules to monitor CalDAV/CardDAV endpoint access patterns.
- Deploy file integrity monitoring (FIM) on shared servers — tools like AIDE or OSSEC can detect root-level tampering post-exploitation.
- Isolate high-value tenants onto dedicated servers or VPS instances. Shared hosting is not appropriate for clients handling sensitive data, payment processing, or regulatory workloads.
- Subscribe to cPanel's LTS release channel and enforce automated update policies. Given the current disclosure velocity, manual patching is too slow.
- Hunt for lateral movement: check database access logs for cross-account queries, and review WP Toolkit action logs for database operations initiated by accounts that don't own the target database.
The shared hosting industry has long operated on a thin margin of trust — the assumption that cPanel's account isolation is robust enough for multi-tenant use. CVE-2026-87899 is a stark reminder that this assumption is a single patch cycle away from catastrophe. Providers who delay patching are not just accepting risk for themselves; they're accepting it on behalf of every customer on the server.
