cPanel’s Privilege Split
cPanel’s 29 September fixes cover every supported version: one permits root-level code execution; two concern stored scripts in WHM. The advisories do not state whether any was exploited.
Root execution
CVE-2026-93698 involves insufficient validation in the Multilang adminbin. Exploitation can execute commands as root with full server control. The advisory omits prerequisites, so it does not establish unauthenticated access.
Browser authority
CVE-2026-93697 lets an unprivileged account holder store script in Mass Modify Accounts that runs in a WHM administrator’s session.
CVE-2026-93029 has the same session risk in Manage SSL Hosts. This is browser authority, not operating-system root access.
Verify builds
| Product line | Minimum patched build |
|---|---|
| cPanel/WHM 110 | 11.110.0.148 |
| cPanel/WHM 134 | 11.134.0.61 |
| cPanel/WHM 136 | 11.136.0.45 |
| cPanel/WHM 138 | 11.138.0.11 |
| WP Squared 138 | 11.138.1.13 |
cPanel recommends the latest patch. Check every server’s full build against its row, not its major number.
This is not the earlier EmailTrack flaw
BlackTree’s earlier cPanel report covered a different EmailTrack path with a mail-related account prerequisite and older fixed builds.
Sources
- CVE-2026-93698: 29 September 2026, 16:41 UTC.
- CVE-2026-93697: 29 September 2026, 16:53 UTC.
- CVE-2026-93029: 29 September 2026, 16:47 UTC.
