# CVE-2026-87899

Authenticated remote code execution to root in cPanel

- Page: https://www.vulneraibility.com/cve/CVE-2026-87899
- CVSS: 9.4
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.61% (percentile 49.6)
- CISA SSVC: exploitation none, automatable no, technical impact total (assessed 2026-09-23)
- Weakness: CWE-250
- Published: 2026-09-23

## Affected versions

- WebPros cPanel: affected >= 11.120.0.0 and < 11.134.0.57; >= 11.136.0.0 and < 11.136.0.41; >= 11.138.0.0 and < 11.138.0.8; fixed in < 11.134.0.57, < 11.136.0.41, < 11.138.0.8

A version outside these ranges is not a statement that it is unaffected.

## Impact

Authenticated attackers can execute arbitrary code as root, enabling full server compromise, data theft, service disruption, and lateral movement.

## Action

Immediate action required

## Recommendation

Apply vendor update ASAP; restrict admin access, rotate creds, monitor logs

## References

- [other] https://support.cpanel.net/hc/en-us/articles/43591715125271

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.