Back to Security Advisories

Security: CVE-2026-105476 Arbitrary File Write as Root in cPanel & WHM – October 26, 2026

CVE-2026-105476 lets a cPanel user direct a root-privileged process into writing a file to a location of the reseller's choosing — arbitrary file write as root, fixed in cPanel 110.0.154, 134.0.67, 136.0.51, 138.0.19 or later (v78 and later affected). Resellers are the referenced actor, so update with sudo /scripts/upcp --force immediately.

High 8.8 CVSS
cPanel

What this means under a SharedLicense license

Arbitrary file write as root is full-server compromise in slow motion: a written cron file, SSH key or system unit turns into command execution as root at the attacker's convenience.

Situation

A security vulnerability was discovered in cPanel & WHM, which allows a user to direct a root-privileged process into writing a file to a location of the reseller’s choosing.

Affected product version

Product Affected versions Patched versions
cPanel & WHM v78 and later
  • 110.0.154 or later
  • 134.0.67 or later
  • 136.0.51 or later
  • 138.0.19 or later

Impact

Successful exploitation can allow a reseller account on the server to create or overwrite files anywhere on the server as the root user. 

Call to action

Update to the latest patched version: How do I update cPanel/WHM?

Frequently Asked Questions

What is CVE-2026-105476?
It is a vulnerability in cPanel & WHM (v78 and later affected) that allows a user to direct a root-privileged process into writing a file to a location of the reseller's choosing — arbitrary file write as root, disclosed October 26, 2026.
Which cPanel versions fix CVE-2026-105476?
110.0.154 or later, 134.0.67 or later, 136.0.51 or later, and 138.0.19 or later — the same October 26 patched builds that fix CVE-2026-105475, so one upcp covers both.
How do I apply the fix?
Run sudo /scripts/upcp --force and verify the cPanel version in WHM reports one of the patched builds. Review recently modified cron files, SSH authorized_keys and systemd units for signs of abuse while you update.
Why does a file-write flaw matter as much as code execution?
Because writing files as root is code execution with one extra step: a dropped cron job, an SSH key, or a modified system service file executes at root privilege on the attacker's schedule.

References

Security Advisories

Related Advisories

ConfigServer Security & Firewall (CSF) 16.35-1 — cPanel & WHM Update

2026-11-09

ConfigServer Security & Firewall (CSF) 16.34-1 — cPanel & WHM Update

2026-11-02

PHP Security Release – CVE-2026-115560

2026-10-24

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System