Affected Systems
All supported versions of cPanel and WHM (release lines 11.110, 11.134, 11.136, 11.138, and WP Squared). Fixed in builds 11.110.0.143, 11.134.0.55, 11.136.0.39, 11.138.0.4, and 11.138.1.9 (WP Squared). Any authenticated hosting account with mail privileges can exploit this vulnerability.
Exploitation Status
No public exploit code or active exploitation confirmed as of September 9, 2026. Not listed in CISA KEV catalog. However, repositories claiming exploits for similar recent cPanel flaws (July and August 2026) are publicly available, suggesting exploit development is feasible.
Business Impact
An authenticated hosting account with mail privileges can achieve full root compromise of the entire cPanel/WHM server. This grants access to all hosting accounts, databases, files, credentials, and enables malware installation, hidden account creation, and lateral movement into customer networks. Shared hosting providers face catastrophic multi-tenant breach risk. CVSS score not yet published; similar August 2026 cPanel flaw scored 8.7 (High). No workaround or interim mitigation provided by vendor.
Urgency
🔴 Immediate
Recommended Actions
- Immediately upgrade all cPanel/WHM servers to fixed builds: 11.110.0.143, 11.134.0.55, 11.136.0.39, 11.138.0.4, or 11.138.1.9 (WP Squared) via WHM Home / cPanel / Upgrade to Latest Version or run '/usr/local/cpanel/scripts/upcp --force' as root
- Review EmailTrack module logs and database query logs for suspicious SQL injection attempts or unexpected file creation activity prior to patching
- Audit all hosting accounts with mail privileges for unauthorized file modifications, new cron jobs, or suspicious processes running with elevated privileges
- Monitor for new root-level accounts, SSH keys, or backdoors created after compromise; check /root/.ssh/authorized_keys and /etc/passwd for anomalies
- If immediate patching is not possible, consider temporarily restricting mail privileges for untrusted hosting accounts until update can be applied