cPanel vulnerabilities
CVEs whose affected-version data names the cPanel package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
9 CVEsRSS
CVE-2026-93698Critical· 9.9Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.
Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.
CVE-2026-93697Critical· 9.0There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.
There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.
CVE-2026-93029Critical· 9.0There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.
There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.
CVE-2026-87899Critical· 9.4Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges.
Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges.
CVE-2026-68490High· 8.2Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts.
Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts.
CVE-2026-67401Critical· 9.9PoCA vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component
A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component
CVE-2026-65643High· 8.8PoCEval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.
Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.
CVE-2026-41940Critical· 9.8CISA KEV0dayPoCcPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
CVE-2025-66429High· 8.8An issue was discovered in cPanel 110 through 132
An issue was discovered in cPanel 110 through 132. A directory traversal vulnerability within the Team Manager API allows for overwrite of an arbitrary file. This can allow for privilege escalation to the root user.