cPanel root vulnerability exposes shared-hosting isolation flaws

Immediate Threat: Any Account Can Spawn Root Shells

On September 22, 2026, cPanel disclosed a critical cPanel root vulnerability in its CalDAV/CardDAV service that allows a logged-in hosting account to execute code with root privileges on the underlying server (CVE-2026-87899) Thehackernews. The vulnerability is not remote; it activates once an attacker obtains legitimate credentials for any cPanel account on a shared host. Because shared-hosting providers typically sell dozens or hundreds of accounts per physical server, the attack surface expands to every paying customer.

Technical Mechanics: Service Misconfiguration Leads to Privilege Escalation

The cPanel root vulnerability resides in how the CalDAV/CardDAV daemon handles file-system paths for calendar and contact storage. The daemon runs as a privileged system user but fails to properly sanitize the path supplied by the authenticated cPanel session. An attacker can craft a request that points the daemon to an arbitrary location, causing it to execute a malicious script with root UID/GID. The exploit chain requires only a valid cPanel username and password; no additional privileges such as sudo are needed.

A related issue (CVE-2026-87900) affects the WP Toolkit plugin. The plugin’s database-creation routine does not verify ownership, allowing a logged-in user to modify databases belonging to other accounts. While the impact is less severe than full root, it demonstrates a pattern of insufficient isolation across cPanel’s modular components.

Why the Assumption That "Shared Hosting Is Safe" Is Flawed

The industry often promotes shared-hosting platforms as cost-effective and "secure by design" because each tenant is sandboxed by the control panel. The cPanel root vulnerability directly contradicts that narrative. Isolation is enforced at the application layer, not at the kernel level. When a privileged service like CalDAV runs with elevated rights and trusts user-supplied input, the sandbox collapses. This reality should force operators to reconsider blanket reliance on control-panel isolation for multi-tenant environments.

Affected Deployments and Patch Landscape

cPanel lists the following fixed builds:

• 11.134.0.57 or later
• 11.136.0.41 or later
• 11.138.0.8 or later
• WP Squared 11.138.1.11 or later (WP Toolkit fix)

All servers running version 120 or later but below these builds remain exploitable. The vendor provides no temporary workaround; the only mitigation is to apply the official update. For WP Toolkit, administrators must run the installer script provided by cPanel to upgrade to version 6.11.3 or later.

Operational Impact: Immediate Action Required

Shared-hosting providers must treat this as a critical emergency. The attack vector—valid credentials—means that credential-theft incidents (phishing, credential stuffing, or reused passwords) instantly become a path to full server takeover. Operators should:

1. Force password resets for all accounts and enforce MFA where possible.
2. Run the WHM upgrade command /usr/local/cpanel/scripts/upcp --force on every node.
3. Verify the installed build via cat /usr/local/cpanel/version and cross-check against the fixed versions.
4. Audit logs for anomalous CalDAV/CardDAV requests in the days preceding the patch release.
5. Communicate the urgency to customers, emphasizing that the flaw does not require prior compromise.

Failure to patch promptly could result in attackers installing persistent rootkits, exfiltrating data from all tenants, or using the compromised server as a launchpad for further attacks against downstream customers.

Broader Implications for Cloud-Native Hosting

The cPanel root vulnerability mirrors recent supply-chain concerns where a single component’s misconfiguration compromises an entire ecosystem. It underscores the need for defense-in-depth at the container and VM layers, even for traditional LAMP stacks. Providers should consider running privileged services inside isolated containers or employing Kubernetes PodSecurityPolicies to restrict root execution, thereby limiting the blast radius of any future control-panel flaw.

Regulatory Lens: Potential Compliance Violations

If a compromised server stores personally identifiable information (PII) or payment data, the breach could trigger obligations under GDPR, CCPA, or PCI-DSS. Regulators increasingly view shared-hosting isolation failures as a lapse in reasonable security controls. Organizations that rely on vulnerable cPanel instances may need to report the incident within the statutory 72-hour window if customer data is exposed.

What to Watch Next

cPanel has not disclosed active exploitation, and the flaws were absent from the CISA Known Exploited Vulnerabilities catalog at the time of reporting. However, public disclosure itself is a catalyst for opportunistic actors. Security researchers should monitor underground forums for proof-of-concept scripts targeting the CalDAV path traversal. Additionally, watch for any chained exploits that combine the root flaw with the WP Toolkit database manipulation to achieve lateral movement across tenant accounts.

External Reference

For a comparable case where a privileged service flaw led to full server compromise, see the analysis of the recent LiteSpeed Enterprise vulnerability that also allowed a single hosting account to gain root access.

Further Reading

For hardening recommendations, see our guide on Shared-hosting security best practices.

Related coverage

• Cisco 0-Day Vulnerability Exposes Users to Remote Exploitation
• Vercel Patches Critical Next.js ImageResponse RCE Flaw (CVE-2026-94545)
• Linux Kernel Vulnerability Gives ARM64 KVM Guests Read-Write Access to Host Memory

Explore more on this topic

• More cpanel coverage