Security: CVE-2026-105476 Arbitrary File Write as Root in cPanel & WHM – October 26, 2026

CVE-2026-105476 lets a cPanel user direct a root-privileged process into writing a file to a location of the reseller's choosing — arbitrary file write as root, fixed in cPanel 110.0.154, 134.0.67, 136.0.51, 138.0.19 or later (v78 and later affected). Resellers are the referenced actor, so update with sudo /scripts/upcp --force immediately.

High 8.8 CVSS 2026-10-19

cPanel

SharedLicense लाइसेंस के तहत इसका अर्थ

Arbitrary file write as root is full-server compromise in slow motion: a written cron file, SSH key or system unit turns into command execution as root at the attacker's convenience.

Situation

A security vulnerability was discovered in cPanel & WHM, which allows a user to direct a root-privileged process into writing a file to a location of the reseller’s choosing.

Affected product version

Product	Affected versions	Patched versions
cPanel & WHM	v78 and later	110.0.154 or later 134.0.67 or later 136.0.51 or later 138.0.19 or later

Impact

Successful exploitation can allow a reseller account on the server to create or overwrite files anywhere on the server as the root user.

Call to action

Update to the latest patched version: How do I update cPanel/WHM?

अक्सर पूछे जाने वाले प्रश्न

What is CVE-2026-105476?

It is a vulnerability in cPanel & WHM (v78 and later affected) that allows a user to direct a root-privileged process into writing a file to a location of the reseller's choosing — arbitrary file write as root, disclosed October 26, 2026.

Which cPanel versions fix CVE-2026-105476?

110.0.154 or later, 134.0.67 or later, 136.0.51 or later, and 138.0.19 or later — the same October 26 patched builds that fix CVE-2026-105475, so one upcp covers both.

How do I apply the fix?

Run sudo /scripts/upcp --force and verify the cPanel version in WHM reports one of the patched builds. Review recently modified cron files, SSH authorized_keys and systemd units for signs of abuse while you update.

Why does a file-write flaw matter as much as code execution?

Because writing files as root is code execution with one extra step: a dropped cron job, an SSH key, or a modified system service file executes at root privilege on the attacker's schedule.

संदर्भ

सुरक्षा सलाह

अपने सिस्टम में भेद्यताओं की जाँच करें

अपना उत्पाद और ऑपरेटिंग सिस्टम चुनें ताकि आपके लिए लागू सटीक फिक्स कमांड देख सकें।

अपना सिस्टम जाँचें