cPanel Patches a Root Exploit in Its Calendar Service

cPanel fixed a flaw that let any authenticated hosting account run code as root on a shared server, the company said in a security release Tuesday, the most severe of three bugs patched in its CalDAV and CardDAV calendar service.

The most severe, CVE-2026-87899, is a privilege-escalation bug: an authenticated account holder is not supposed to reach past the boundary of their own account. cPanel's advisory says the flaw in CalDAV and CardDAV, the standard protocols cPanel and WHM use to sync calendars and contacts to a phone or a desktop mail client, let one do exactly that, running code with root privileges instead of the account's own. On a server where a hosting provider sells accounts to the public, that means any paying customer could take over the machine running every other customer's site, not just their own.

cPanel and WHM, short for WebHost Manager, run the account, billing and server-administration layer beneath a large share of shared-hosting providers, which is what turns a bug reachable by any logged-in customer into a server-wide problem rather than an account-level one. Both services affected here ship enabled by default on cPanel and WHM version 120 and later.

Two more bugs in the same service

cPanel disclosed two related flaws alongside the root-escalation bug, both reported by the same researcher.

CVE	What it allows	Fixed in
CVE-2026-87899	Any account runs code as root	11.134.0.57, 11.136.0.41, 11.138.0.8
CVE-2026-68490	Reads another account's calendar and contacts	Same builds
CVE-2026-87900	Edits another account's WP Toolkit database	WP Toolkit 6.11.3

CVE-2026-68490 is read-only: a local user can see the names, emails and meeting schedules in a neighboring account's calendar, which does not hand over the server but does hand an attacker material for a phishing attempt. CVE-2026-87900, in WP Toolkit rather than CalDAV or CardDAV, lets a logged-in user modify a database belonging to a different account.

Who found it, and how to patch

Ali Mustafa, who publishes under the handle rz1027, is credited with reporting all three bugs; the same researcher has also reported vulnerabilities in Plesk, a competing hosting control panel, since Aug. 27, 2026. cPanel and WHM installations patch through the standard upgrade path, Home > cPanel > Upgrade to Latest Version in WHM, or by running /usr/local/cpanel/scripts/upcp --force as root. There is no separate workaround for administrators who cannot upgrade immediately; both outlets that reported the flaws describe the fixed build as the only mitigation cPanel has published.

cPanel is not the only hosting-adjacent platform patching an authenticated-to-root-style bug in 2026: WordPress 7.1.1 closed an RCE chain that started from a single malicious link, and Forgejo fixed a 9.9-severity RCE in its own template repositories.

cPanel's advisory does not publish a CVSS score for any of the three bugs, and neither cPanel nor the outlets that reported on it have said whether the root-escalation flaw was exploited before the patch shipped.