cPanel & WHM Security Updates (August–October 2026): 7 CVEs + WP Toolkit — How to Patch
Between 27 August and 1 October 2026 cPanel published fixes for seven cPanel & WHM vulnerabilities and two WP Toolkit vulnerabilities. Several of them let an ordinary cPanel account holder create files, run commands or raise their privileges on the server. One cPanel update fixes all seven; WP Toolkit is a separate package and needs its own update. Both updates are safe to run on a production server and take about 15 minutes in total.
Using Plesk or DirectAdmin? These advisories cover cPanel & WHM and WP Toolkit for cPanel only.
What was fixed
| CVE | Published | Area | What it allowed |
|---|---|---|---|
| CVE-2026-65643 | 27 Aug 2026 | Domain parking | An account holder who can add parked or addon domains could create arbitrary files on the server |
| CVE-2026-67401 | 8 Sep 2026 | EmailTrack | SQL injection: an account holder with mail privileges could create arbitrary files on the server |
| CVE-2026-87899 | 22 Sep 2026 | CalDAV / CardDAV | An authenticated cPanel account holder could escalate their privileges |
| CVE-2026-68490 | 22 Sep 2026 | CalDAV / CardDAV | A local user could read other accounts' calendars and contacts |
| CVE-2026-93029 | 29 Sep 2026 | WHM » Manage SSL Hosts | Stored cross-site scripting (XSS) that could run code in the WHM interface |
| CVE-2026-93697 | 29 Sep 2026 | WHM » Modify Accounts | Stored cross-site scripting (XSS) that could run code in the WHM interface |
| CVE-2026-93698 | 29 Sep 2026 | Multilang adminbin | Insufficient validation let arbitrary commands run |
| CVE-2026-87900 | 22 Sep 2026 | WP Toolkit — database creation | Unsafe handling of database-creation commands |
| CVE-2026-93699 | 1 Oct 2026 | WP Toolkit — handler | Could lead to arbitrary code execution |
Step 1 — Check your cPanel version
Run as root:
cat /usr/local/cpanel/versionThe second number is your release tier (for example 11.134.0.58 is tier 134). You are covered for all seven cPanel vulnerabilities if your build is at least:
| Release tier | Safe build (or later) |
|---|---|
| 110 | 11.110.0.148 |
| 134 | 11.134.0.61 |
| 136 | 11.136.0.45 |
| 138 | 11.138.0.11 |
| WP Squared | 11.138.1.13 |
If your tier is not in this table, open a ticket before updating and we'll tell you which supported tier to move to.
Step 2 — Update cPanel & WHM
tslzCP ; /scripts/upcp --forceThe first command refreshes your cPanel licence so the update runs against an active licence; the second forces the update. It usually takes 5–15 minutes and your sites stay online while it runs.
When it finishes, run the Step 1 check again. Your build must now match the table or be newer.
Step 3 — Update WP Toolkit
WP Toolkit is updated separately from cPanel. You need version 6.11.4 or later, which fixes both WP Toolkit vulnerabilities.
Check your version:
rpm -q wp-toolkit-cpanel
On Ubuntu: dpkg -s wp-toolkit-cpanel | grep Version
If it reports that the package is not installed, WP Toolkit is not on your server and there is nothing to do here.
Update it:
AlmaLinux, Rocky Linux and CloudLinux 8 or later:
dnf update wp-toolkit-cpanelCentOS 7 / CloudLinux 7:
yum update wp-toolkit-cpanelUbuntu:
apt install --only-upgrade wp-toolkit-cpanelRun the version check again. It must show 6.11.4 or later. WP Toolkit normally updates itself every night; this makes sure you have the fix now.
More current advisories
Our Server Security Advisories page lists other issues affecting cPanel, CloudLinux and LiteSpeed servers.
Managed-service customers
If your server is under one of our Server Management plans, we apply these updates for you. Open a ticket if you'd like confirmation for your server. Not on a plan and would rather we did it? Open a ticket, share access, and we'll update cPanel and WP Toolkit and verify both.