CVE-2026-87899 - Vulnerability Details - OpenCVE

Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Webpros	Cpanel

No data.

No data.

References

Link	Providers
https://support.cpanel.net/hc/en-us/articles/43591715125271

History

Wed, 23 Sep 2026 22:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Webpros Webpros cpanel
Vendors & Products		Webpros Webpros cpanel

Wed, 23 Sep 2026 20:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 23 Sep 2026 20:00:00 +0000

Type	Values Removed	Values Added
Description		Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges.
Weaknesses		CWE-250
References		https://support.cpanel.net/hc/en-us/articles/43591715125271
Metrics		cvssV4_0 `{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}`

MITRE

Status: PUBLISHED

Assigner: hackerone

Published: 2026-09-23T19:52:47.216Z

Updated: 2026-09-24T03:55:45.144Z

Reserved: 2026-09-09T15:00:00.573Z

Link: CVE-2026-87899

Vulnrichment

Updated: 2026-09-23T20:04:28.597Z

NVD

Status : Awaiting Analysis

Published: 2026-09-23T20:17:20.480

Modified: 2026-09-24T21:16:28.120

Link: CVE-2026-87899

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-87899", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "state": "PUBLISHED", "assignerShortName": "hackerone", "dateReserved": "2026-09-09T15:00:00.573Z", "datePublished": "2026-09-23T19:52:47.216Z", "dateUpdated": "2026-09-24T03:55:45.144Z"}, "containers": {"cna": {"descriptions": [{"lang": "en", "value": "Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges."}], "affected": [{"vendor": "WebPros", "product": "cPanel", "versions": [{"version": "11.120.0.0", "status": "affected", "lessThan": "11.134.0.57", "versionType": "semver"}, {"version": "11.136.0.0", "status": "affected", "lessThan": "11.136.0.41", "versionType": "semver"}, {"version": "11.138.0.0", "status": "affected", "lessThan": "11.138.0.8", "versionType": "semver"}, {"version": "11.134.0.57", "status": "unaffected", "lessThan": "11.134.0.57", "versionType": "semver"}, {"version": "11.136.0.41", "status": "unaffected", "lessThan": "11.136.0.41", "versionType": "semver"}, {"version": "11.138.0.8", "status": "unaffected", "lessThan": "11.138.0.8", "versionType": "semver"}]}], "references": [{"url": "https://support.cpanel.net/hc/en-us/articles/43591715125271"}], "metrics": [{"cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "baseScore": 9.4, "baseSeverity": "CRITICAL"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "cweId": "CWE-250", "description": "CWE-250 Execution with Unnecessary Privileges"}]}], "credits": [{"lang": "en", "value": "Ali Mustafa (rz1027)", "type": "finder"}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2026-09-23T19:52:47.216Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-23T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-87899"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-24T03:55:45.144Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-87899", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-23T20:04:24.267251Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-23T20:04:28.597Z"}}], "cna": {"credits": [{"lang": "en", "type": "finder", "value": "Ali Mustafa (rz1027)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.4, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}}], "affected": [{"vendor": "WebPros", "product": "cPanel", "versions": [{"status": "affected", "version": "11.120.0.0", "lessThan": "11.134.0.57", "versionType": "semver"}, {"status": "affected", "version": "11.136.0.0", "lessThan": "11.136.0.41", "versionType": "semver"}, {"status": "affected", "version": "11.138.0.0", "lessThan": "11.138.0.8", "versionType": "semver"}, {"status": "unaffected", "version": "11.134.0.57", "lessThan": "11.134.0.57", "versionType": "semver"}, {"status": "unaffected", "version": "11.136.0.41", "lessThan": "11.136.0.41", "versionType": "semver"}, {"status": "unaffected", "version": "11.138.0.8", "lessThan": "11.138.0.8", "versionType": "semver"}]}], "references": [{"url": "https://support.cpanel.net/hc/en-us/articles/43591715125271"}], "descriptions": [{"lang": "en", "value": "Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-250", "description": "CWE-250 Execution with Unnecessary Privileges"}]}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2026-09-23T19:52:47.216Z"}}}, "cveMetadata": {"cveId": "CVE-2026-87899", "state": "PUBLISHED", "dateUpdated": "2026-09-24T03:55:45.144Z", "dateReserved": "2026-09-09T15:00:00.573Z", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "datePublished": "2026-09-23T19:52:47.216Z", "assignerShortName": "hackerone"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "cPanel", "vendor": "WebPros", "versions": [{"lessThan": "11.134.0.57", "status": "affected", "version": "11.120.0.0", "versionType": "semver"}, {"lessThan": "11.136.0.41", "status": "affected", "version": "11.136.0.0", "versionType": "semver"}, {"lessThan": "11.138.0.8", "status": "affected", "version": "11.138.0.0", "versionType": "semver"}, {"lessThan": "11.134.0.57", "status": "unaffected", "version": "11.134.0.57", "versionType": "semver"}, {"lessThan": "11.136.0.41", "status": "unaffected", "version": "11.136.0.41", "versionType": "semver"}, {"lessThan": "11.138.0.8", "status": "unaffected", "version": "11.138.0.8", "versionType": "semver"}]}], "source": "support@hackerone.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges."}], "id": "CVE-2026-87899", "lastModified": "2026-09-24T21:16:28.120", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "support@hackerone.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-87899", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-23T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-09-23T20:17:20.480", "references": [{"source": "support@hackerone.com", "url": "https://support.cpanel.net/hc/en-us/articles/43591715125271"}], "sourceIdentifier": "support@hackerone.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-250"}], "source": "support@hackerone.com", "type": "Secondary"}]}