cPanel has disclosed a set of security flaws in its cPanel & WHM hosting control panel, and the most severe of them is about as bad as it gets for a hosting environment: a path to arbitrary command execution as root. Published on September 29, 2026, the advisory affects every supported cPanel & WHM release prior to the vendor’s patched versions, meaning the exposure window spans a huge number of shared hosting and managed server deployments worldwide.

A Direct Line to Full Server Compromise

The headline issue, tracked as CVE-2026-93698, stems from insufficient input validation in the Multilang adminbin component. cPanel’s advisory describes it plainly: the weakness allows arbitrary command execution, and that execution happens with root privileges. On a hosting server, root access doesn’t just mean one compromised account — it means every hosting account, website, database, and service running on that machine becomes reachable to the attacker in one shot.

That makes this a materially different risk profile than a typical web application bug. An attacker who successfully exploits the Multilang adminbin flaw could read or modify data across every customer hosted on the box, drop persistent malware, create new privileged accounts, harvest credentials, disable security tooling, and rewrite server configuration — all without needing to compromise each hosted site individually. For hosting providers and managed-service companies running shared infrastructure, a single unpatched server can translate into a mass-compromise event affecting dozens or hundreds of downstream customers.

Two Additional Stored XSS Flaws in WHM

The advisory also covers a pair of related cross-site scripting vulnerabilities that, while less severe than the command-execution bug, still carry meaningful risk in a multi-tenant hosting context. CVE-2026-93029 affects the WHM Manage SSL Hosts interface: a lower-privileged account holder could plant malicious script content that executes later when a WHM administrator views the affected page. Because that script runs inside the administrator’s own authenticated browser session, it can potentially carry out actions with the administrator’s own permissions — modifying server settings, managing hosting accounts, or altering SSL configuration.

CVE-2026-93697 follows the same pattern in a different location, the WHM Mass Modify Accounts interface. As with the SSL Hosts bug, successful exploitation requires an attacker to store malicious content that an administrator subsequently opens, at which point the injected code runs with the administrator’s session privileges. Both stored XSS issues effectively let a lower-tier account escalate its influence by hijacking an administrator’s browser rather than attacking the server directly — a reminder that privilege boundaries inside shared hosting panels can be more porous than they look.

Patch Availability and Timing

cPanel has shipped fixes across its supported release lines. The patched versions are 11.110.0.148, 11.134.0.61, 11.136.0.45, 11.138.0.11, and WP2 11.138.1.13 — the same set of fixed releases applies to all three CVEs covered in the advisory (CVE-2026-93029, CVE-2026-93697, and CVE-2026-93698). At the time of disclosure, no public proof-of-concept exploit code had surfaced in available vulnerability-tracking sources. That’s a modest point in defenders’ favor, but detailed technical advisories tend to accelerate independent exploit development, particularly for internet-facing WHM interfaces that administrators haven’t gotten around to updating.

Recommended Response

Given the severity of the root-level command execution flaw in particular, hosting providers and server administrators should treat this as an urgent, non-negotiable patching priority rather than routine maintenance. Beyond simply applying the update, a thorough response should include:

• Upgrading cPanel & WHM to the latest patched release for your product line without delay.
• Reviewing WHM administrator activity logs, authentication records, and any newly created privileged user accounts for signs of prior compromise.
• Auditing cron jobs and server or hosting-account configuration changes for anything unexpected.
• Restricting WHM access using firewall rules, VPN-only access, IP allowlisting, and multi-factor authentication, rather than leaving the administrative interface broadly reachable.
• Reviewing the privileges granted to lower-level account holders and investigating any suspicious input submitted through the SSL-host management, account-modification, or Multilang-related functions named in the advisory.

Because cPanel & WHM sits underneath such a large share of the shared and reseller hosting market, the practical impact of this disclosure will depend heavily on how quickly providers push the update out — and how many smaller operators are still running outdated, internet-exposed WHM panels by the time attackers start probing for them.