All vulnerabilities
CVE-2026-87899

Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges.

WebPros cPanelApplications & CMS
Open in ThreatlineRecord JSON
CVSS
9.4Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.58%Chance of exploitation activity in the next 30 days, higher than 46% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in11.134.0.57Also 11.136.0.41, 11.138.0.8CVE List
Published23 Sep 2026Updated 24 Sep 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Affected versions 6

  • cPanelaffected: 11.120.0.0 before 11.134.0.57CVE List
  • cPanelaffected: 11.136.0.0 before 11.136.0.41CVE List
  • cPanelaffected: 11.138.0.0 before 11.138.0.8CVE List
  • cPanelunaffected: 11.134.0.57 before 11.134.0.57CVE List
  • cPanelunaffected: 11.136.0.41 before 11.136.0.41CVE List
  • cPanelunaffected: 11.138.0.8 before 11.138.0.8CVE List

References 1