cPanel shipped fixes for three security flaws on July 29, patching every supported branch on the same day. For anyone running a shared server, the detail that matters is not the count but the direction: two of the three let one account reach past its own boundary, the line that is supposed to keep hosting customers apart from each other and from the machine underneath. One of the two needs no login at all. None is reported as exploited, and cPanel attaches no severity score, but the mechanics are worth understanding, because the mitigations that buy time each carry a cost. cPanel and WHM sit under a large share of the world’s shared-hosting accounts, so a flaw that lets one tenant affect another is not an edge case for the platform. It is a test of the property the platform is sold to provide.
The Two That Cross the Line, and the One That Doesn’t
The first, CVE-2026-58047, is an HTTP request smuggling weakness in cpsrvd, the daemon that serves cPanel, WHM, and webmail on ports 2083, 2087, and 2096. cPanel describes it plainly: in some situations, an unauthenticated remote attacker may be able to manipulate the responses cpsrvd delivers to other users on the same server. The conditions are limited and the wording is careful, but the shape is the one shared hosting exists to prevent, a request from outside, no account required, bending what another tenant sees. Request smuggling is the class of flaw that lets one connection’s data bleed into another’s, and cpsrvd sits in front of authenticated panel and webmail traffic, which is exactly where that kind of bleed would matter.
The second, CVE-2026-58048, needs a login but goes further. An authenticated cPanel account with access to the MySQL or MariaDB feature, in other words an ordinary hosting customer, could potentially run arbitrary database commands with full administrative privileges. Depending on the operating system and database engine configuration, cPanel says that access may extend to the operating system itself. On a box shared by dozens or hundreds of customers, that is the escalation that can turn one paying account into a risk to every other site on the server. The advisory credits Vincent55 Yang for reporting it responsibly.
The third fix, carrying the Exim identifier GCVE-25-2026-07-45-3, is more contained. A local user’s .forward file can trigger unsafe string expansion in Exim’s redirect router, and under cPanel’s default configuration the injected command runs as the cPanel user, letting a Team User sub-accountclimb to the account that owns it. That is an escalation inside one customer’s own hierarchy rather than a reach across tenants, and it affects Exim builds below 4.99.5.
The Fix Is Out; the Workarounds Cost Something
cPanel released patched builds across every maintained branch at once: 11.110.0.137, 11.126.0.78, 11.134.0.48, 11.136.0.32, and 138.1.6 for the WP2 line. Servers on automatic updates will pick them up. The rest should not wait, because all supported versions are affected and the advisories are now public, which is usually when opportunistic scanning starts.
For operators who cannot upgrade at once, cPanel offers a mitigation for each flaw, and each has a price. Disabling cpsrvd backend connection reuse closes the smuggling path but forces a fresh TCP and TLS handshake on every request to those three ports, adding latency and CPU load on busy servers. Revoking the MySQL feature from cPanel accounts blunts the database bug but stops customers adding or removing databases. Reviewing Exim’s forwarding rules for forced-command options handles the mail flaw by hand. cPanel presents all three as stopgaps, to be reverted once the upgrade lands. The update is the clean answer, and it is already out. What makes these worth the interruption is not a severity number cPanel never assigned, but arithmetic: on a shared server, a bug’s cost is multiplied by every neighbour on the machine, and two of these three are bugs about the neighbours.
About the Data
This account is drawn from cPanel’s three security advisories, published July 29, 2026, and its public build list, which shows the patched versions released the same day. cPanel does not attach CVSS scores to these notices, so the severity language here is the vendor’s own, quoted as written: limited conditions, some situations, may, and potentially. No exploitation in the wild has been reported at the time of writing, and one of the three was credited to an outside researcher under responsible disclosure. Figures and quotations follow the advisories.
