cPanel WHM Privilege Escalation Code Execution Vulnerabilities | MSSP Advisory

cPanel and Web Host Manager released patches for three vulnerabilities including CVE-2026-29201 with insufficient input validation that enables privilege escalation, code execution, and denial-of-service attacks. The vulnerabilities target the adminbin call system and feature file handling within cPanel installations. These flaws affect any MSSP running cPanel infrastructure or managing clients with cPanel-based hosting environments.

Your own cPanel instances used for internal hosting or development environments become attack vectors that could compromise your entire operation through privilege escalation. Every client running shared hosting, VPS, or dedicated servers with cPanel needs immediate patching guidance because these vulnerabilities give attackers direct paths to their web applications and databases.

📬