cPanel disclosed two patched cPanel & WHM vulnerabilities on October 30, 2026. CVE-2026-105476 could let a reseller account direct a root-privileged process to create or overwrite files anywhere on the server. CVE-2026-105475 could expose the calendar and contact data of hosted mail accounts to an unauthenticated attacker.
Editorial status: Published; security claims reflect cited advisories and are subject to further updates. Patch event date: October 26, 2026. Disclosure/publication date: October 30, 2026. Source checked: November 2, 2026. Updated: November 2, 2026. Verification: Corroborated.
What Happened
cPanel says CVE-2026-105476 affects cPanel & WHM version 78 and later. Patched minimum versions are 110.0.154, 134.0.67, 136.0.51 and 138.0.19. Successful exploitation requires a reseller account but could allow files to be created or overwritten as the root user.
A separate advisory says CVE-2026-105475 affects version 124 and later. Patched minimum versions are 134.0.67, 136.0.51 and 138.0.19. cPanel says an attacker needs no account or credentials to read calendar entries and contacts belonging to mail accounts hosted on the server.
Why It Matters
cPanel is common in shared and reseller hosting. The first flaw crosses an important account boundary because a reseller-level user could influence a root process. The second concerns confidentiality: a vulnerable server could expose address-book and calendar records without authentication.
The affected-version ranges are different, so administrators should compare the installed release tier with both advisories rather than assuming a server outside one range is outside the other.
What the Company Says
cPanel directs administrators to update to the latest patched version. Its version 110 changelog records security hardening in 110.0.154 on October 26, along with component and authentication changes.
HostingReviewLab Context
These are control-panel vulnerabilities, not evidence that every website hosted behind cPanel was compromised. On managed shared hosting, the provider usually controls the cPanel & WHM version. VPS and dedicated-server customers may be responsible for the control-panel update themselves. Our hosting security responsibility guide explains how to identify that boundary.
What We Haven't Independently Verified
HostingReviewLab has not reproduced either vulnerability, reviewed exploit code, confirmed exploitation in the wild or audited any provider’s rollout. The cPanel advisories do not state how the issues were discovered, how long they were exploitable or whether telemetry showed abuse before patching.
What Customers Should Know
- Server administrators should confirm that the installed build meets the patched minimum for their release tier.
- Shared and reseller hosting customers should ask the provider whether cPanel & WHM was updated and on what date.
- Resellers should review unexpected root-owned file changes and security logs if their provider says the server was exposed.
- Mail customers handling sensitive contact or calendar data should ask whether the server fell within the affected range and whether the provider found suspicious access.
- Do not treat a current cPanel login page as proof that the underlying server build is patched.
Sources
- cPanel advisory for CVE-2026-105476 — updated October 30, 2026; checked November 2, 2026.
- cPanel advisory for CVE-2026-105475 — updated October 30, 2026; checked November 2, 2026.
- cPanel & WHM version 110 changelog — patch dated October 26, 2026; checked November 2, 2026.