CVE-2026-93697 cPanel CVE debrief

Who should care

WHM administrators and users with unprivileged accounts should assess exposure and update to patched versions to prevent exploitation of the stored XSS vulnerability. WHM administrators and users with unprivileged accounts should assess exposure and update to patched versions to prevent exploitation. Successful exploitation allows an unprivileged account holder to execute script in the context of a WHM administrator's session, which can be used to perform.

Why it matters

WHM administrators and users should assess exposure and update to patched versions to prevent exploitation of the stored XSS vulnerability.

• An unprivileged account holder can execute script in the context of a WHM administrator's session.
• The vulnerability can be used to perform administrative actions as that user.
• Successful exploitation requires updating to patched versions to prevent.

Technical summary

The vulnerability exists in the WHM Mass Modify Accounts interface, allowing an unprivileged account holder to execute script in the context of a WHM administrator's session. The vulnerability can be used to perform administrative actions as that user. Successful exploitation requires updating to patched versions to prevent. The CVE record was published on 2026-09-29T14:34:31.000Z and has not been modified since then. WHM administrators and users with unprivileged accounts should assess exposure and update to patched versions to prevent exploitation.

Defensive priority

Update to the latest patched version: 11.110.0.148 or later, 11.134.0.61 or later, 11.136.0.45 or later, 11.138.0.11 or later, or WP2: 11.138.1.13 or later.

Recommended defensive actions

• Update cPanel/WHM to version 11.110.0.148 or later
• Update cPanel/WHM to version 11.134.0.61 or later
• Update cPanel/WHM to version 11.136.0.45 or later
• Update cPanel/WHM to version 11.138.0.11 or later
• Update WP2 to version 11.138.1.13 or later

Evidence notes

The CVE record and source item metadata indicate a stored XSS vulnerability in WHM's Account Modification Interfaces. The vendor, cPanel, has provided patched versions for cPanel/WHM. The vulnerability exists in the WHM Mass Modify Accounts interface, allowing an unprivileged account holder to execute script in the context of a WHM administrator's session. Successful exploitation allows an unprivileged account holder to execute script in the context of a WHM administrator's session, which can be used to perform administrative actions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.