CVE-2026-68490

🚨 CPANEL CVE-2026-87899: CALDAV/CARDDAV PATH TO ROOT ON SHARED HOSTING cPanel / WebPros published an official security advisory for CVE-2026-87899 in cPanel’s CalDAV/CardDAV stack (disclosed September 22, 2026). An authenticated cPanel account holder can escalate via CalDAV/CardDAV to code execution as root, giving full server control. The issue affects cPanel/WHM v120 or later and is especially relevant for shared hosting, where any customer account is enough — WHM admin access is not required. Fixed builds include 11.134.0.57+, 11.136.0.41+, 11.138.0.8+, and WP Squared 11.138.1.11+. ⚠️ Analyst Note: The vendor advisory does not claim known in-the-wild exploitation, and this CVE was not listed in CISA KEV as of our check. Treat as a high-priority patching item for hosting providers and anyone running affected cPanel/WHM builds. Credit: Ali Mustafa (rz1027). Related same-day official cPanel CalDAV/CardDAV and WP Toolkit advisories exist (CVE-2026-68490, CVE-2026-87900); this post focuses on the root-escalation path. Primary: https://support.cpanel.net/hc/en-us/articles/43591715125271-Security-CVE-2026-87899-Vulnerability-in-cPanel-s-CalDAV-CardDAV-September-22-2026 #DDW #cPanel #CVE202687899 #WebHosting #PrivilegeEscalation #RCE #ThreatIntelligence #CyberSecurity

🔴 cPanel'de CalDAV/CardDAV işlevselliğinde iki güvenlik açığı (CVE-2026-68490, CVE-2026-87899) yamalandı. • CVE-2026-68490: Aynı sunucudaki local kullanıcıların diğer hesaplara ait takvim ve kişi verilerini okumasına izin verebiliyor. • CVE-2026-87899: Kimliği doğrulanmış bir cPanel hesabının yetkisini yükselterek root olarak kod çalıştırmasına ve sunucunun tamamen ele geçirilmesine yol açabiliyor. cPanel sürümlerinizi mutlaka güncelleyin! Örneğin: cPanel 136 kullanıcıları için: 11.136.0.41+ cPanel 138 kullanıcıları için: 11.138.0.8+ ... https://support.cpanel.net/hc/en-us/articles/43591715125271-Security-CVE-2026-87899-Vulnerability-in-cPanel-s-CalDAV-CardDAV-September-22-2026 https://support.cpanel.net/hc/en-us/articles/43502940099991-Security-CVE-2026-68490-Vulnerability-in-cPanel-s-CalDAV-CardDAV-Functionality-September-22-2026

Root access is not supposed to be a hosting feature, but cPanel just admitted it is one right now. On September 22 the company disclosed a flaw in its CalDAV and CardDAV service (CVE-2026-87899, CVE-2026-68490) that lets anyone with a plain cPanel account run code as root and take full control of the server. No privilege escalation tricks needed, just a login. That matters for every AI agent or bot currently deployed on shared cPanel boxes, which is a large share of budget cloud hosting. If an agent's process, cron job, or API key sits on a server where another tenant can become root, isolation between accounts stops being real. A second bug, in the WP Toolkit plugin used to manage WordPress sites (CVE-2026-87900), lets one account modify databases belonging to another, no root needed for that one. Fixes exist. cPanel & WHM users patch through WHM's Upgrade to Latest Version or by running upcp --force as root, which also repairs calendar permissions on existing accounts. WP Toolkit needs a separate manual update to 6.11.3 via its installer script, since it ships as its own package. There is no workaround for servers that can't update yet, and no public proof-of-concept has surfaced as of September 23. Any pipeline that spins up agents on shared or low-cost VPS hosting should confirm the provider has actually pushed these builds, not just scheduled them. A hosting bill is cheap. Rebuilding trust in a compromised host is not.

🚨 ONE cPANEL ACCOUNT COULD TAKE OVER THE ENTIRE HOSTING SERVER cPanel has patched a serious flaw in its CalDAV/CardDAV service: CVE-2026-87899 A logged-in cPanel customer can potentially: Normal hosting account ↓ Trigger vulnerable service ↓ Execute code as ROOT ↓ Take full control of shared server That's especially dangerous on shared hosting. One customer account may coexist with: → Hundreds of websites → Databases → Email accounts → Credentials → Customer files Two more flaws were patched alongside it. CVE-2026-87900 allows one cPanel account to modify databases belonging to other accounts through WP Toolkit. CVE-2026-68490 can expose other users' calendar and contact data. No active exploitation has been reported. But hosting providers should not treat this like a normal application patch. CyberSignal insight: Multi-tenant systems live or die by isolation. When one tenant becomes root, multi-tenancy stops existing. Source: cPanel · The Hacker News #Cybersecurity #WebHosting #Linux

Any AI agent or automated workload running on a shared cPanel server has a new root-level risk to close out this week. cPanel disclosed three flaws on September 22. The worst, CVE-2026-87899 in the CalDAV/CardDAV service, lets any standard hosting account run code as root and take full control of the server. No special privileges required, just a working account login. A second flaw, CVE-2026-87900 in WP Toolkit, lets one account holder modify databases belonging to other accounts on the same server. A third, CVE-2026-68490, lets a local user read other accounts' calendar and contact data, without write access or root. None of the three has a known workaround. No exploitation has been reported, and none appears in CISA's Known Exploited Vulnerabilities catalog as of September 23. For cPanel & WHM: go to Home / cPanel / Upgrade to Latest Version, or run /usr/local/cpanel/scripts/upcp --force as root. For WP Toolkit: update to 6.11.3 or later with the installer script from http://wp-toolkit.plesk.com. Automatic updates are not confirmed to cover this version, so run it manually. Any agent, script, or pipeline provisioning or managing sites on cPanel infrastructure should verify the build number before its next deployment cycle, not after.