Back to Security Advisories

Security: CVE-2026-93698 Vulnerability in Multilang Adminbin – September 29, 2026

CVE-2026-93698 is insufficient validation in the cPanel/WHM Multilang adminbin that allows arbitrary command execution — disclosed by cPanel on September 29, 2026, and the most severe of the three advisories published that day. Successful exploitation leads to code execution as the root user, so update cPanel/WHM to a patched release immediately.

Critical 9.9 CVSS
cPanel

What this means under a SharedLicense license

Successful exploitation leads to code execution as the root user — full control of the server and every account, website, and database on it.

Situation

Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.

Affected Product Versions

Product Affected Versions Patched Versions
cPanel/WHM All supported versions
  • 11.110.0.148 or later
  • 11.134.0.61 or later
  • 11.136.0.45 or later
  • 11.138.0.11 or later
  • WP2: 11.138.1.13 or later

Impact

Successful exploitation leads to code execution as the root user, giving an attacker full control of the server and every account, website, and database on it.

Call to action

Update to the latest patched version: How do I update cPanel/WHM?

Frequently Asked Questions

What is CVE-2026-93698?
It is the CVE ID cPanel assigned to insufficient validation in the Multilang adminbin that allows arbitrary commands to be executed, published September 29, 2026. All supported cPanel/WHM versions are affected. cPanel has not published a CVSS score for it yet.
Which cPanel/WHM versions are affected and which are patched?
All supported cPanel/WHM versions are affected. Patched versions are 11.110.0.148, 11.134.0.61, 11.136.0.45 and 11.138.0.11 or later — the fix spans the 11.110, 11.134, 11.136 and 11.138 release tiers, plus WP2 11.138.1.13.
How do I fix CVE-2026-93698?
Update cPanel/WHM immediately: run sudo /scripts/upcp --force. The patched builds are 11.110.0.148, 11.134.0.61, 11.136.0.45 and 11.138.0.11 or later (WP2: 11.138.1.13 or later).
Is CVE-2026-93698 being exploited in the wild?
cPanel's advisory does not report any active exploitation, and no CVSS score has been published yet. Because the impact ranges from admin-session takeover to root code execution, treat the update as urgent.

References

Security Advisories

Related Advisories

EasyApache 4 25.86 — cPanel & WHM Update

2026-10-01

ConfigServer Security & Firewall (CSF) 16.32-1 — cPanel & WHM Update

2026-09-30

Sitejet Builder 4.13.1-1 — cPanel & WHM Update

2026-09-30

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System