CVE-2026-93698
cPanel: Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.
Webpros cPanelApplications & CMS
CVSS
9.9CriticalExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.63%Chance of exploitation activity in the next 30 days, higher than 49% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 11.138.0.11cPanelCVE List
- 11.136.0.45cPanelCVE List
- 11.134.0.61cPanelCVE List
- 11.110.0.148cPanelCVE List
- 11.138.1.13WP SquaredCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.
Text from CVE List
Affected versions 5
- cPanelaffected: all versions before 11.138.0.11CVE List
- cPanelaffected: all versions before 11.136.0.45CVE List
- cPanelaffected: all versions before 11.134.0.61CVE List
- cPanelaffected: all versions before 11.110.0.148CVE List
- WP Squaredaffected: all versions before 11.138.1.13CVE List
References 7
- docs.cpanel.net/changelogs/138-change-log/#138011Fixvia CVE List
- docs.cpanel.net/changelogs/136-change-log/#136045Fixvia CVE List
- docs.cpanel.net/changelogs/134-change-log/#134061Fixvia CVE List
- docs.cpanel.net/changelogs/110-change-log/#1100148Fixvia CVE List
- docs.wpsquared.com/changelogs/versions/changelog/#138113Fixvia CVE List
- support.cpanel.net/hc/en-us/articles/43845931719447-Security-CVE-2026-93698-Vulnerability-in-Multilang-Adminbin-September-29-2026Advisoryvia CVE List
- hackerone.com/reports/4054291Referencevia CVE List