Blog
cPanel CalDAV Root Flaw (CVE-2026-87899): Any Hosting Account Can Take the Whole Server
Tabla de Contenidos
cPanel disclosed three vulnerabilities on September 23, 2026, and one of them is the shared-hosting nightmare scenario: a logged-in hosting account — any customer on the box — escalating to root through the CalDAV/CardDAV calendar service. No special privileges, no clever chain. If you run or sell shared hosting, patch before this weekend.
What CVE-2026-87899 Does
“Execution with unnecessary privileges” in cPanel & WHM’s CalDAV/CardDAV service (the component that syncs calendars and contacts to mobile devices) lets a remote authenticated user run arbitrary code as root. On a shared server that means one tenant owns every tenant: all customer sites, mailboxes, databases, and backups. CVSS 4.0 base score: 9.4 (Critical).
The Two Companions in the Same Advisory
- CVE-2026-87900 — argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier. A logged-in cPanel user can modify databases belonging to other customer accounts. Fixed in WP Toolkit 6.11.3.
- CVE-2026-68490 — also CalDAV/CardDAV: incorrect permissions let a local user read other accounts’ calendar events and contacts. No root, but a cross-tenant privacy break. CVSS 8.2.
Affected Versions and the Fixed Builds
| Component | Affected | Fixed in |
|---|---|---|
| cPanel & WHM (87899 + 68490) | 120 and later | 11.134.0.57 · 11.136.0.41 · 11.138.0.8 · WP Squared 11.138.1.11 |
| WP Toolkit (87900) | 6.11.2-10794 and earlier | 6.11.3 |
Not in CISA’s KEV catalog at disclosure time — but a one-account-to-root bug in the default calendar stack is exactly the profile that gets scanned within days.
Fix It Now (Both Steps)
1. cPanel & WHM — force the update as root:
/usr/local/cpanel/scripts/upcp --force
cat /usr/local/cpanel/version2. WP Toolkit — the panel update does not cover it; it’s a separate package. Official installer command:
¿Necesitas el mejor precio en licencias de servidor?
Obtén cPanel, DirectAdmin, LiteSpeed y más con entrega instantánea y soporte 24/7.
bash <(curl https://wp-toolkit.plesk.com/cPanel/installer.sh || wget -O - https://wp-toolkit.plesk.com/cPanel/installer.sh) --version 6.11.3The WHM update also repairs calendar and contact permissions for existing accounts — one more reason to run it rather than hand-patching.
Frequently Asked Questions
Do I need to be on a shared server for this to matter?
Root escalation via the calendar service needs a cPanel account login — so a single-site reseller box with one customer is enough. VPS owners who hand clients panel accounts are squarely in scope.
How do I know my build is patched?
Run cat /usr/local/cpanel/version. Anything below the fixed builds listed above for your release tier is vulnerable. Our live version tracker lists the current cPanel release.
Where is the official advisory?
In cPanel’s Security TSR feed and the NVD records (CVE-2026-87899, CVE-2026-87900, CVE-2026-68490). We mirror hosting-relevant items in the security advisories archive.
Does my SharedLicense cPanel license keep working after the update?
Yes — the update changes nothing about licensing. See cPanel licenses or last month’s hosting security roundup.
Conclusion
Calendar sync is a feature nobody watches — which is precisely why this one hurts. Two commands, root shells closed. Patch, verify, move on.
