CVE-2026-87899 cPanel CVE debrief

Who should care

System administrators and security teams responsible for cPanel/WHM installations should assess exposure and prioritize remediation. They should review and verify the integrity of cPanel/WHM installations, monitor for suspicious activity related to CalDAV and CardDAV functionality, and ensure that updates are applied to affected systems. Security teams should also verify the integrity of cPanel/WHM installations and review official advisories for guidance.

Why it matters

CVE-2026-87899 is a high-severity vulnerability in cPanel's CalDAV and CardDAV functionality that allows authenticated account holders to escalate privileges, potentially leading to code execution as the root user. System administrators and security teams should assess exposure, prioritize remediation, and verify the integrity of cPanel/WHM installations.

• Potential code execution as the root user
• Full control of the server by an attacker
• Privilege escalation through CalDAV and CardDAV functionality
• Need for verification of affected versions and remediation

Technical summary

The vulnerability allows an authenticated cPanel account holder to escalate their privileges through cPanel's CalDAV and CardDAV functionality, potentially leading to code execution as the root user. This vulnerability affects cPanel/WHM versions v120 or later. Patched versions are available, including 11.134.0.57 or later, 11.136.0.41 or later, 11.138.0.8 or later, and WP2: 11.138.1.11 or later. Successful exploitation leads to code execution as the root user, giving an attacker full control of the server. System administrators should assess exposure and prioritize remediation.

Defensive priority

High

Recommended defensive actions

• Update cPanel/WHM to the latest patched version (11.134.0.57 or later, 11.136.0.41 or later, 11.138.0.8 or later, or WP2: 11.138.1.11 or later)
• Review and verify the integrity of cPanel/WHM installations
• Monitor for suspicious activity related to CalDAV and CardDAV functionality
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability was responsibly disclosed by Ali Mustafa (rz1027). The CVE record and NVD entry provide details on the vulnerability, but the CVSS score and severity are not available. Limited source detail is available, so defenders should verify affected versions and review official advisories for additional information. No exploit activity has been reported. This CVE was published on 2026-09-18T16:08:29.000Z.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.