Multiple Cpanel/WHM Vulnerabilities Allow Arbitrary Command Execution On Server

Multiple security flaws in cPanel & WHM could let attackers run malicious scripts in an administrator’s browser session or execute arbitrary commands as root. The vulnerabilities were disclosed on September 29, 2026, and affect all supported cPanel & WHM versions before the vendor’s patched releases. Administrators should update immediately, as a successful attack against the command-execution flaw could expose every hosting account, website, database, and service hosted on an affected machine. The most severe issue, CVE-2026-93698, affects the Multilang adminbin component and can result in full server compromise. CVE-2026-93029 is a stored cross-site scripting vulnerability in the WHM Manage SSL Hosts interface. An...

Read the full article at the source.