cPanel has released an emergency security update to fix a critical vulnerability that could allow authenticated hosting users to execute SQL commands with the database server’s root privileges. The flaw, tracked as CVE-2026-58048, received a CVSS 4.0 score of 9.4 and affects all supported versions of cPanel & WHM as well as WP Squared.
According to cPanel, the vulnerability enables an authenticated cPanel account with MySQL or MariaDB access to execute arbitrary SQL commands in the database’s administrative context. In certain server configurations, successful exploitation could even lead to operating system-level compromise.
A Serious Privilege Escalation Vulnerability
Under normal circumstances, cPanel restricts database users to database-level permissions, preventing them from obtaining global administrative privileges.
However, CVE-2026-58048 bypasses these restrictions during cPanel’s database renaming process. According to the HackerOne CNA record, the issue occurs because SQL mode is not preserved while a database is being renamed, causing SQL statements to execute using the database root account instead of the user’s limited privileges.
The vulnerability is classified differently across security records:
- cPanel describes it as a privilege escalation issue.
- The CVE CNA classifies it as CWE-89 (SQL Injection).
Although both references describe the same vulnerability, neither provides technical details about the injected input, affected SQL mode, or exploitation payload.
Patched Versions
Administrators should update immediately to one of the following patched releases:
- 11.110.0.137
- 11.118.0.71
- 11.126.0.78
- 11.134.0.48
- 11.136.0.32
- WP Squared 138.1.6
Systems that cannot be updated immediately can temporarily reduce risk by disabling the MySQL feature for cPanel users. Existing databases will continue functioning, but users will no longer be able to create or delete databases until updates are applied.
Administrators can update from WHM or execute:
/usr/local/cpanel/scripts/upcp --force
CISA Assessment
CISA’s August 4 vulnerability enrichment lists:
- Exploitation Status: None observed
- Automatable: No
- Technical Impact: Total
While no active exploitation has been reported, CISA’s assessment represents a point-in-time snapshot and should not be interpreted as a guarantee against future attacks.
Second Vulnerability: HTTP Request Smuggling
The same security release also addresses CVE-2026-58047 (CVSS 5.6), an HTTP request-smuggling vulnerability affecting cpsrvd, the daemon responsible for serving cPanel and WHM interfaces.
Under specific conditions, an unauthenticated remote attacker could manipulate responses sent to other users connected to the same server, potentially exposing login credentials.
Temporary Mitigation
If immediate patching is not possible, administrators can disable backend connection reuse by setting:
cpsrvd_keepalives_disabled=1
in:
/var/cpanel/cpanel.config
and then restarting cpsrvd.
cPanel notes that this workaround forces a new TCP and TLS connection for every request on ports 2083, 2087, and 2096, which may increase CPU utilization and latency on heavily loaded servers.
Both CVE-2026-58048 and CVE-2026-58047 were reported by security researcher Vincent55 Yang.
Exim Vulnerabilities Also Fixed
The release also includes security updates for Exim, the mail transfer agent bundled with cPanel.
GCVE-25-2026-07-45-3
A vulnerability involving users’ .forward files could trigger unsafe string expansion in Exim’s redirect router when specific pipe transport configurations are enabled.
Under cPanel’s default configuration, the vulnerable code executes as the cPanel account owner. In some scenarios, this could allow Team User sub-accounts to elevate privileges.
GCVE-25-2026-07-45-1
Exim version 4.99.5 also fixes a separate High-severity directory traversal vulnerability that could allow local attackers to access files outside the mail spool directory and potentially escalate privileges.
Documentation Inconsistency
One notable issue in the release is an inconsistency between cPanel’s security advisories.
The advisory for CVE-2026-58048 lists 11.118.0.71 as a patched release. However, the advisories covering the HTTP request-smuggling vulnerability and the Exim fixes omit the entire 11.118 branch from their patched version lists.
Administrators running the 11.118 branch should verify their installed build against the database vulnerability advisory instead of relying solely on the shorter patch lists.
Final Thoughts
Although exploitation of CVE-2026-58048 requires valid cPanel credentials and database access, the potential impact is significant. On shared hosting platforms, where multiple customers share the same server, the vulnerability could allow one compromised or malicious account to gain database administrative privileges and, depending on the server configuration, potentially compromise the underlying operating system.
Organizations running cPanel servers should prioritize installing the latest security updates, review user access permissions, and implement temporary mitigations where immediate patching is not feasible. Even in environments where all accounts belong to a single organization, compromised credentials remain a realistic attack vector, making timely patch management essential.
