CVE-2026-87899

Published Sep 23, 2026

Last updated 8 hours ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-87899 is a vulnerability found in the CalDAV and CardDAV service of cPanel & WHM. This flaw allows an authenticated user with a cPanel hosting account to execute arbitrary code with root privileges. Exploitation of this vulnerability can lead to an attacker gaining full control of the server. cPanel has released fixed versions to address this issue, specifically cPanel & WHM versions 11.134.0.57 or later, 11.136.0.41 or later, and 11.138.0.8 or later.

Description: Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges.
Source: support@hackerone.com
NVD status: Received

Risk scores

CVSS 4.0

Type: Secondary
Base score: 9.4
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: CRITICAL

Weaknesses

support@hackerone.com: CWE-250

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 12

References