Back to Security Advisories

Security: CVE-2026-93029 Stored XSS in WHM’s Manage SSL Hosts Interface – September 29, 2026

CVE-2026-93029 is a stored XSS vulnerability in the WHM Manage SSL Hosts interface that allows arbitrary code execution, disclosed by cPanel on September 29, 2026. An unprivileged account holder can execute script in a WHM administrator's session context, so update cPanel/WHM to a patched release.

Critical 9 CVSS
cPanel

What this means under a SharedLicense license

Successful exploitation allows an unprivileged account holder to execute script in the context of a WHM administrator's session, which can be used to perform administrative actions as that user.

Situation

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.

Affected Product Versions

Product Affected Versions Patched Versions
cPanel/WHM All supported versions
  • 11.110.0.148 or later
  • 11.134.0.61 or later
  • 11.136.0.45 or later
  • 11.138.0.11 or later
  • WP2: 11.138.1.13 or later

Impact

Successful exploitation allows an unprivileged account holder to execute script in the context of a WHM administrator’s session, which can be used to perform administrative actions as that user.

Call to action

Update to the latest patched version: How do I update cPanel/WHM?

Frequently Asked Questions

What is CVE-2026-93029?
It is the CVE ID cPanel assigned to a stored XSS vulnerability in the WHM Manage SSL Hosts interface, published September 29, 2026. All supported cPanel/WHM versions are affected. cPanel has not published a CVSS score for it yet.
Which cPanel/WHM versions are affected and which are patched?
All supported cPanel/WHM versions are affected. Patched versions are 11.110.0.148, 11.134.0.61, 11.136.0.45 and 11.138.0.11 or later — the fix spans the 11.110, 11.134, 11.136 and 11.138 release tiers, plus WP2 11.138.1.13.
How do I fix CVE-2026-93029?
Update cPanel/WHM: run sudo /scripts/upcp --force. The patched builds are 11.110.0.148, 11.134.0.61, 11.136.0.45 and 11.138.0.11 or later (WP2: 11.138.1.13 or later).
Is CVE-2026-93029 being exploited in the wild?
cPanel's advisory does not report any active exploitation, and no CVSS score has been published yet. Because the impact ranges from admin-session takeover to root code execution, treat the update as urgent.

References

Security Advisories

Related Advisories

EasyApache 4 25.86 — cPanel & WHM Update

2026-10-01

ConfigServer Security & Firewall (CSF) 16.32-1 — cPanel & WHM Update

2026-09-30

Sitejet Builder 4.13.1-1 — cPanel & WHM Update

2026-09-30

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System