cPanel CalDAV/CardDAV CVE-2026-87899: authenticated hosting account → root RCE (fix 11.134.0.57 / 11.136.0.41 / 11.138.0.8)
cPanel support advisory (22 September 2026) documents CVE-2026-87899: an authenticated cPanel account holder can escalate through CalDAV/CardDAV functionality to code execution as root and full server control. Affects cPanel/WHM v120 or later; patched in 11.134.0.57+, 11.136.0.41+, 11.138.0.8+. CISA's ADP entry on the CVE record lists exploitation as none. Credited to Ali Mustafa (rz1027). (sources: cPanel support CVE-2026-87899; CVE record CVE-2026-87899)
UPDATE (24 Oct 2026): The CVE record (HackerOne as CNA) scores CVE-2026-87899 at 9.4 under CVSS 4.0 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). (source: CVE record CVE-2026-87899)
Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: CVE record CVE-2026-87899)
- Product
- cPanel & WHM CalDAV/CardDAV (shared hosting account → root); related WP Toolkit database-creation path
- Versions
- CVE-2026-87899: cPanel/WHM 11.120 or later before 11.134.0.57 / 11.136.0.41 / 11.138.0.8 (per the CVE record)
- CVSS
- 9.4 (CVSS 4.0, CVE record from HackerOne CNA; cPanel advisory publishes no score)
- Exploited in Australia?
- unknown
- Patch to
- Update cPanel/WHM to 11.134.0.57+, 11.136.0.41+, or 11.138.0.8+; prioritise shared-hosting nodes where untrusted customers hold cPanel accounts