Zurück zu den Sicherheitshinweisen

Security: CVE-2026-93698 Vulnerability in Multilang Adminbin – September 29, 2026

CVE-2026-93698 is insufficient validation in the cPanel/WHM Multilang adminbin that allows arbitrary command execution — disclosed by cPanel on September 29, 2026, and the most severe of the three advisories published that day. Successful exploitation leads to code execution as the root user, so update cPanel/WHM to a patched release immediately.

Critical 9.9 CVSS
cPanel

Was das unter einer SharedLicense-Lizenz bedeutet

Successful exploitation leads to code execution as the root user — full control of the server and every account, website, and database on it.

Situation

Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.

Affected Product Versions

Product Affected Versions Patched Versions
cPanel/WHM All supported versions
  • 11.110.0.148 or later
  • 11.134.0.61 or later
  • 11.136.0.45 or later
  • 11.138.0.11 or later
  • WP2: 11.138.1.13 or later

Impact

Successful exploitation leads to code execution as the root user, giving an attacker full control of the server and every account, website, and database on it.

Call to action

Update to the latest patched version: How do I update cPanel/WHM?

Häufig gestellte Fragen

What is CVE-2026-93698?
It is the CVE ID cPanel assigned to insufficient validation in the Multilang adminbin that allows arbitrary commands to be executed, published September 29, 2026. All supported cPanel/WHM versions are affected. cPanel has not published a CVSS score for it yet.
Which cPanel/WHM versions are affected and which are patched?
All supported cPanel/WHM versions are affected. Patched versions are 11.110.0.148, 11.134.0.61, 11.136.0.45 and 11.138.0.11 or later — the fix spans the 11.110, 11.134, 11.136 and 11.138 release tiers, plus WP2 11.138.1.13.
How do I fix CVE-2026-93698?
Update cPanel/WHM immediately: run sudo /scripts/upcp --force. The patched builds are 11.110.0.148, 11.134.0.61, 11.136.0.45 and 11.138.0.11 or later (WP2: 11.138.1.13 or later).
Is CVE-2026-93698 being exploited in the wild?
cPanel's advisory does not report any active exploitation, and no CVSS score has been published yet. Because the impact ranges from admin-session takeover to root code execution, treat the update as urgent.

Referenzen

Sicherheitshinweise

Verwandte Warnhinweise

EasyApache 4 25.86 — cPanel & WHM Update

2026-10-01

ConfigServer Security & Firewall (CSF) 16.32-1 — cPanel & WHM Update

2026-09-30

Sitejet Builder 4.13.1-1 — cPanel & WHM Update

2026-09-30

System auf Schwachstellen prüfen

Wählen Sie Ihr Produkt und Betriebssystem, um die passenden Fix-Befehle zu sehen.

System prüfen