cPanel released security updates for three vulnerabilities in cPanel & WHM that could enable root-level code execution or let attackers abuse an authenticated WHM administrator session.
All supported versions are affected before the relevant patched builds, making prompt upgrades essential for hosting providers and organizations operating cPanel-managed servers.
The most serious issue, tracked as CVE-2026-93698, affects the Multilang adminbin component. cPanel describes the flaw as insufficient input validation that lets attackers execute arbitrary commands through Multilang adminbin.
Multiple cPanel & WHM Vulnerabilities
Successful exploitation can result in code execution as the Linux root user, giving an attacker the highest level of control over an affected server.
Root-level access presents an immediate risk to shared-hosting infrastructure. An intruder with root permissions could access hosted websites, modify application files, steal email and database content, alter server configuration, deploy persistence mechanisms, or compromise every customer account hosted on the system.
Rapid7 lists CVE-2026-93698 with a CVSS v3 score of 9.9 and a vector showing network reachability, low attack complexity, and a low-privilege requirement.
The remaining vulnerabilities, CVE-2026-93029 and CVE-2026-93697, are stored cross-site scripting flaws in WHM administrative interfaces. CVE-2026-93029 affects the Manage SSL Hosts interface, while CVE-2026-93697 affects WHM account-modification functionality.
In both cases, an unprivileged cPanel account holder can store malicious script content that executes when a WHM administrator later accesses the vulnerable page.
Although stored XSS is often treated as a browser-side issue, these flaws target WHM’s privileged control plane. The malicious script runs in the security context of the administrator’s authenticated session and can perform administrative actions available to that user.
This creates a substantial session-hijacking and privilege-abuse risk, especially in multi-tenant hosting environments where untrusted customers can interact with a shared management platform.
Potential post-exploitation actions could include changing SSL host settings, modifying account configurations, creating or altering hosting accounts, changing passwords, or establishing persistence through administrative features exposed to the hijacked WHM session.
Administrators should review privileged WHM activity, account changes, SSL configuration updates, and unexpected command execution for signs that an attacker may have attempted to exploit these weaknesses.
cPanel published the advisories on September 29, 2026. Administrators should update to the latest available release rather than only targeting the minimum corrected build.
The published remediation guidance identifies patched versions of cPanel & WHM as 11.110.0.148 or later, 11.134.0.61 or later, 11.136.0.45 or later, and 11.138.0.11 or later. WP Squared users should update to version 11.138.1.13 or later.
While updates are being deployed, organizations should restrict WHM administration to trusted IP addresses, enforce multi-factor authentication for all privileged users, and minimize accounts with WHM-level permissions.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
