cPanel Patches a Root Escalation That Starts From an Ordinary Hosting Account

cPanel published three security advisories on September 22. In the most serious, for CVE-2026-87899, the company writes that “an authenticated cPanel account holder can escalate their privileges through cPanel’s CalDAV and CardDAV functionality,” and that successful exploitation “leads to code execution as the root user, giving an attacker full control of the server.”

No condition beyond holding an account is listed. On a server where accounts are sold to the public, that puts the starting point inside the customer base, and means a compromised customer account could become a route to the machine that hosts everyone else on it.

Key facts

• The cadence: this is the second targeted security release on the 134 and 136 lines in a fortnight, after the September 8 EmailTrack build.
• The fix: builds 11.134.0.57, 11.136.0.41 and 11.138.0.8, dated September 22 in cPanel’s change logs, plus 11.138.1.11 on WP Squared.
• The second flaw: in WP Toolkit, an authenticated cPanel user could modify databases belonging to other accounts. It patches separately, to 6.11.3.
• No score: none of the three advisories carries a CVSS rating, and no CVE record for them had been published when we checked on September 24.

Three Flaws, Two Update Paths

The three advisories were published together and credit one researcher, Ali Mustafa, who goes by rz1027. Two sit in cpdavd, the service that has handled CalDAV and CardDAV since version 120, and one in WP Toolkit. They do not all patch the same way.

The two calendar flaws are listed as affecting cPanel and WHM version 120 or later, and the patched builds named are on the 134, 136 and 138 lines, plus WP Squared. That boundary is not arbitrary. Version 120 is where cPanel, in its own words, “deprecated and removed the Calendar and Contacts Server (CCS) plugin” and moved CalDAV and CardDAV into cpdavd. The 110 line, which took a fixed build in the EmailTrack advisory two weeks earlier, sits below that change.

The calendar-reading flaw is bounded in a way the root escalation is not. Its advisory states plainly that reading other accounts’ calendars and contacts “does not grant the ability to modify that data, and it does not grant rootaccess.” It also notes that updating “corrects the permissions used for new calendar and address book storage and repairs the permissions on existing accounts,” so the fix reaches accounts created before it.

WP Toolkit does not travel with the rest. It is a separate package with its own version number, and the advisory’s instruction is a manual installer command pinned to 6.11.3. A server brought up to a patched cPanel build is not thereby on a patched WP Toolkit.

The description is also the thinnest of the three: a security issue “in the handling of database-creation commands,” with no statement of whether data in other accounts can be read as well as changed, or whether the user needs access to WP Toolkit itself. WP Toolkit also ships for Plesk, but cPanel’s advisory does not address whether Plesk deployments are affected.

Four Root Escalations Across cPanel and Plesk

Read against cPanel’s own change logs, September 22 is not an isolated date. On the 134 and 136 lines it is the second targeted security release in a fortnight. The first came on September 8 and carried the EmailTrack flaw we covered at the time. A build between them, on September 10, was tagged for security as well, described as “Security hardening. Reverting to an earlier version removes these improvements,” though that entry also carries a long run of routine fixes.

The same researcher’s work reaches WebPros’ other panel. Inside the same fortnight Plesk fixed two Backup Manager flaws, CVE-2026-68488 and CVE-2026-68487, both reported by Mustafa working with a researcher known as abed1526. One is a symlink race during a restore that lets a customer take ownership of a file outside their own subscription, “ultimately leading to full root access to the server.” The other is a path traversal that produces “arbitrary file write as root by an authenticated customer.” Both affect Plesk for Linux and are fixed in 18.0.80.7 and 18.0.79.11. Plesk for Windows is listed as not affected.

Counting the EmailTrack flaw, that is four paths from customer-level access to root or full server compromise, across both of WebPros’ control panels, disclosed inside the same two weeks. All four credit Mustafa, three of them jointly with abed1526.

Three CVE Numbers, No Published Records, No Score

An administrator trying to judge urgency has less to work with than usual. The change log entries for all three builds read “[Security] Targeted Security Release” and name no CVE.

The advisories carry no severity score, and none was available from the CVE database or the National Vulnerability Database either, where no record for any of the three had been published when we checked on September 24. None of the three appears in the US Cybersecurity and Infrastructure Security Agency’s catalog of known exploited vulnerabilities, in the version dated September 23. That catalog has taken a cPanel and WHM flaw before, in April.

No advisory mentions exploitation, and none offers a way to tell whether a server was reached before it was patched. The advisories name no temporary mitigation for machines that cannot take the update immediately.

With no mitigation named, updating is the remedy on offer. On servers that also run WP Toolkit, that means two separate update paths rather than one. A cPanel and WHM server needs 11.134.0.57, 11.136.0.41 or 11.138.0.8, or 11.138.1.11 on WP Squared, which closes both calendar flaws. WP Toolkit needs its own move to 6.11.3.

About the Data

Flaw descriptions, affected versions and patched builds come from cPanel’s three advisories of September 22 and Plesk’s two from the same fortnight, read in full. Build dates come from cPanel’s published change logs, and the move of CalDAV and CardDAV to cpdavd at version 120 from its knowledge base. The reading that September 22 is the second targeted release in two weeks is ours. The CVE and catalog checks were made on September 24.