Security: CVE-2026-105476 Arbitrary File Write as Root in cPanel & WHM – October 26, 2026

CVE-2026-105476 lets a cPanel user direct a root-privileged process into writing a file to a location of the reseller's choosing — arbitrary file write as root, fixed in cPanel 110.0.154, 134.0.67, 136.0.51, 138.0.19 or later (v78 and later affected). Resellers are the referenced actor, so update with sudo /scripts/upcp --force immediately.

High 8.8 CVSS 2026-10-19

cPanel

Was das unter einer SharedLicense-Lizenz bedeutet

Arbitrary file write as root is full-server compromise in slow motion: a written cron file, SSH key or system unit turns into command execution as root at the attacker's convenience.

Situation

A security vulnerability was discovered in cPanel & WHM, which allows a user to direct a root-privileged process into writing a file to a location of the reseller’s choosing.

Affected product version

Product	Affected versions	Patched versions
cPanel & WHM	v78 and later	110.0.154 or later 134.0.67 or later 136.0.51 or later 138.0.19 or later

Impact

Successful exploitation can allow a reseller account on the server to create or overwrite files anywhere on the server as the root user.

Call to action

Update to the latest patched version: How do I update cPanel/WHM?

Häufig gestellte Fragen

What is CVE-2026-105476?

It is a vulnerability in cPanel & WHM (v78 and later affected) that allows a user to direct a root-privileged process into writing a file to a location of the reseller's choosing — arbitrary file write as root, disclosed October 26, 2026.

Which cPanel versions fix CVE-2026-105476?

110.0.154 or later, 134.0.67 or later, 136.0.51 or later, and 138.0.19 or later — the same October 26 patched builds that fix CVE-2026-105475, so one upcp covers both.

How do I apply the fix?

Run sudo /scripts/upcp --force and verify the cPanel version in WHM reports one of the patched builds. Review recently modified cron files, SSH authorized_keys and systemd units for signs of abuse while you update.

Why does a file-write flaw matter as much as code execution?

Because writing files as root is code execution with one extra step: a dropped cron job, an SSH key, or a modified system service file executes at root privilege on the attacker's schedule.

Referenzen

Sicherheitshinweise

System auf Schwachstellen prüfen

Wählen Sie Ihr Produkt und Betriebssystem, um die passenden Fix-Befehle zu sehen.

System prüfen