CVE-2026-87899 – WebPros cPanel

This cPanel update fixes six vulnerabilities. Five are Critical and one is High, and several give an attacker full root control of the hosting server. CVE-2026-67401 has a CVSS score of 9.9, Critical severity. It lets a mail-enabled account run code as root through SQL injection in the EmailTrack component. CVE-2026-93698 has a CVSS score of 9.9, Critical severity. Weak input validation in the Multilang adminbin lets attackers run arbitrary commands. CVE-2026-87899 has a CVSS score of 9.4, Critical severity. It lets remote authenticated users run arbitrary code with root privileges.

CVE-2026-93029 and CVE-2026-93697 each have a CVSS score of 9.0, Critical severity. Both are stored cross-site scripting flaws that allow arbitrary code execution, one in the WHM Manage SSL Hosts interface and one in the WHM Mass Modify Accounts interface. CVE-2026-68490 has a CVSS score of 8.2, High severity. Incorrect permissions let local users read CalDAV and CardDAV data that belongs to other accounts. On a shared hosting server, one compromised account can expose every customer on it, so administrators should deploy this update the same day.