CVE-2026-87900Patch

‼️ ALERT: A new cPanel flaw, CVE-2026-87899, in CalDAV/CardDAV lets any logged-in cPanel account run code as root and take full control of the server. A second flaw, CVE-2026-87900 in WP Toolkit, lets authenticated users modify databases belonging to other accounts. 🔗 Learn more → https://thehackernews.com/2026/09/new-cpanel-flaw-lets-hosting-account_0272795595.html

🚨 CPANEL CVE-2026-87899: CALDAV/CARDDAV PATH TO ROOT ON SHARED HOSTING cPanel / WebPros published an official security advisory for CVE-2026-87899 in cPanel’s CalDAV/CardDAV stack (disclosed September 22, 2026). An authenticated cPanel account holder can escalate via CalDAV/CardDAV to code execution as root, giving full server control. The issue affects cPanel/WHM v120 or later and is especially relevant for shared hosting, where any customer account is enough — WHM admin access is not required. Fixed builds include 11.134.0.57+, 11.136.0.41+, 11.138.0.8+, and WP Squared 11.138.1.11+. ⚠️ Analyst Note: The vendor advisory does not claim known in-the-wild exploitation, and this CVE was not listed in CISA KEV as of our check. Treat as a high-priority patching item for hosting providers and anyone running affected cPanel/WHM builds. Credit: Ali Mustafa (rz1027). Related same-day official cPanel CalDAV/CardDAV and WP Toolkit advisories exist (CVE-2026-68490, CVE-2026-87900); this post focuses on the root-escalation path. Primary: https://support.cpanel.net/hc/en-us/articles/43591715125271-Security-CVE-2026-87899-Vulnerability-in-cPanel-s-CalDAV-CardDAV-September-22-2026 #DDW #cPanel #CVE202687899 #WebHosting #PrivilegeEscalation #RCE #ThreatIntelligence #CyberSecurity

🔴 cPanel WP Toolkit'te güvenlik açığı: CVE-2026-87900 WP Toolkit'teki veritabanı oluşturma işlemlerinde bulunan güvenlik açığı, kimliği doğrulanmış bir cPanel kullanıcısının başka hesaplara ait veritabanlarında değişiklik yapmasına olanak sağlayabiliyor. ⚠️ Etkilenen sürümler: 6.11.2-10794 ve öncesi ✅ Yamalı sürüm: 6.11.3+ cPanel sunucularında WP Toolkit sürümünün kontrol edilmesi ve 6.11.3 veya daha yeni sürüme güncellenmesi öneriliyor. İlgili makale: https://support.cpanel.net/hc/en-us/articles/43597969409943-Security-CVE-2026-87900-Vulnerability-in-WP-Toolkit-Database-Creation-September-22-2026

Root access is not supposed to be a hosting feature, but cPanel just admitted it is one right now. On September 22 the company disclosed a flaw in its CalDAV and CardDAV service (CVE-2026-87899, CVE-2026-68490) that lets anyone with a plain cPanel account run code as root and take full control of the server. No privilege escalation tricks needed, just a login. That matters for every AI agent or bot currently deployed on shared cPanel boxes, which is a large share of budget cloud hosting. If an agent's process, cron job, or API key sits on a server where another tenant can become root, isolation between accounts stops being real. A second bug, in the WP Toolkit plugin used to manage WordPress sites (CVE-2026-87900), lets one account modify databases belonging to another, no root needed for that one. Fixes exist. cPanel & WHM users patch through WHM's Upgrade to Latest Version or by running upcp --force as root, which also repairs calendar permissions on existing accounts. WP Toolkit needs a separate manual update to 6.11.3 via its installer script, since it ships as its own package. There is no workaround for servers that can't update yet, and no public proof-of-concept has surfaced as of September 23. Any pipeline that spins up agents on shared or low-cost VPS hosting should confirm the provider has actually pushed these builds, not just scheduled them. A hosting bill is cheap. Rebuilding trust in a compromised host is not.

cPanel patched critical CalDAV/CardDAV RCE: any hosting account can run code as root (CVE-2026-87899). Also WP Toolkit cross-account DB changes (CVE-2026-87900) and a calendar data leak. Fixed builds out for 134/136/138. https://thehackernews.com/2026/09/new-cpanel-flaw-lets-hosting-account_0272795595.html

🚨 ONE cPANEL ACCOUNT COULD TAKE OVER THE ENTIRE HOSTING SERVER cPanel has patched a serious flaw in its CalDAV/CardDAV service: CVE-2026-87899 A logged-in cPanel customer can potentially: Normal hosting account ↓ Trigger vulnerable service ↓ Execute code as ROOT ↓ Take full control of shared server That's especially dangerous on shared hosting. One customer account may coexist with: → Hundreds of websites → Databases → Email accounts → Credentials → Customer files Two more flaws were patched alongside it. CVE-2026-87900 allows one cPanel account to modify databases belonging to other accounts through WP Toolkit. CVE-2026-68490 can expose other users' calendar and contact data. No active exploitation has been reported. But hosting providers should not treat this like a normal application patch. CyberSignal insight: Multi-tenant systems live or die by isolation. When one tenant becomes root, multi-tenancy stops existing. Source: cPanel · The Hacker News #Cybersecurity #WebHosting #Linux

Any AI agent or automated workload running on a shared cPanel server has a new root-level risk to close out this week. cPanel disclosed three flaws on September 22. The worst, CVE-2026-87899 in the CalDAV/CardDAV service, lets any standard hosting account run code as root and take full control of the server. No special privileges required, just a working account login. A second flaw, CVE-2026-87900 in WP Toolkit, lets one account holder modify databases belonging to other accounts on the same server. A third, CVE-2026-68490, lets a local user read other accounts' calendar and contact data, without write access or root. None of the three has a known workaround. No exploitation has been reported, and none appears in CISA's Known Exploited Vulnerabilities catalog as of September 23. For cPanel & WHM: go to Home / cPanel / Upgrade to Latest Version, or run /usr/local/cpanel/scripts/upcp --force as root. For WP Toolkit: update to 6.11.3 or later with the installer script from http://wp-toolkit.plesk.com. Automatic updates are not confirmed to cover this version, so run it manually. Any agent, script, or pipeline provisioning or managing sites on cPanel infrastructure should verify the build number before its next deployment cycle, not after.

🚨🚨🚨 『Successful exploitation can lead to an authenticated cPanel user being able to perform database modifications in other accounts.』 Security: CVE-2026-87900 Vulnerability in WP Toolkit Database Creation - September 22, 2026 – cPanel https://support.cpanel.net/hc/en-us/articles/43597969409943-Security-CVE-2026-87900-Vulnerability-in-WP-Toolkit-Database-Creation-September-22-2026

cPanel'in Takvim Servisindeki Açık, Paylaşımlı Barındırmada Herhangi Bir Müşterinin Sunucuyu Tamamen Ele Geçirmesine İzin Veriyor! cPanel'in CalDAV ve CardDAV hizmetindeki CVE-2026-87899, oturum açmış herhangi bir hosting hesabı sahibinin root yetkisiyle kod çalıştırıp sunucunun tamamını ele geçirmesine izin veriyor; aynı duyuruda WP Toolkit'teki CVE-2026-87900 (başka hesapların veritabanlarını değiştirme) ve CalDAV/CardDAV'daki CVE-2026-68490 (başka hesapların takvim/kişi verilerine erişim) de kapatıldı. • Paylaşımlı bir sunucuda, sıradan bir hosting hesabına sahip herhangi bir müşteri, bu açığı kullanarak diğer tüm müşterilerin verilerine ve sunucunun kendisine erişebiliyordu. • 8 Eylül'de EmailTrack özelliğinde benzer bir root yetkisi açığı duyurulmuştu; bu da cPanel'de kısa aralıklarla art arda benzer sınıfta açıkların bulunduğunu gösteriyor. Paylaşımlı barındırmada bir müşterinin bir diğerinden tamamen izole olması gereken temel güvenlik ilkesinin, takvim senkronizasyonu gibi yan bir özellik yüzünden tamamen çökebilmesi, hosting sağlayıcılarının müşteri izolasyonunu sadece dosya sistemi düzeyinde değil her hizmet bileşeninde ayrı ayrı doğrulaması gerektiğini gösteriyor. #SiberGüvenlik #cPanel #KritikAçık

@TheHackersNews CalDAV/CardDAV as a root path (CVE-2026-87899) is shared-hosting classic: tenant auth ≠ host boundary. Pair the WP Toolkit cross-account DB issue (CVE-2026-87900) and you’ve got lateral move without needing a public RCE. Patch trains matter more than “we don’t expose calendars.”

CalDAV → root on shared hosting is the same failure mode as an agent tool with host reach: one tenant permission becomes machine takeover. CVE-2026-87899 / CVE-2026-87900: patch now, kill cross-account WP Toolkit paths, and treat every hosting account as a control plane until proven otherwise.