CVE-2026-87899: cPanel CalDAV Account-to-Root - Patch 11.138.0.8 Today

The Situation

On 22 September 2026, cPanel published Security: CVE-2026-87899. One sentence of impact, no mechanism, no CVSS on the advisory itself:

An authenticated cPanel account holder can escalate their privileges through cPanel's CalDAV and CardDAV functionality.

Successful exploitation leads to code execution as the root user, giving an attacker full control of the server.

That is the vendor's wording. We are not adding a chain.

NVD (CNA: HackerOne, published 23 Sep 2026) restates it as Execution with unnecessary privileges (CWE-250): remote authenticated users to execute arbitrary code with root privileges. The CNA's CVSS v4.0 is 9.4 CRITICAL: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. That score is HackerOne Secondary. NVD has not published its own primary metric on the record we pulled.

Same-day, same researcher (Ali Mustafa / rz1027), two more:

• CVE-2026-68490 - same CalDAV/CardDAV surface. A local user can read other accounts' calendar events and contacts. Vendor: no modify, no root. CNA CVSS v4.0 8.2 HIGH, CWE-732. The patch also repairs permissions on existing accounts.
• CVE-2026-87900 - WP Toolkit database-creation handling. Vendor impact: an authenticated cPanel user can perform database modifications in other accounts. NVD/CNA goes further: read arbitrary files and execute arbitrary code across customer accounts (CWE-88, CVSS v4.0 9.4 CRITICAL). Treat the vendor sentence as what cPanel will support; treat the NVD sentence as the CNA's broader claim. They are not the same sentence.

This is not CVE-2026-87886 (Acronis backup plugin, CISA KEV). Different product, different CVE.

Version Floors

From the three cPanel advisories (updated through 23 Sep 2026 on -87899):

cPanel & WHM (CVE-2026-87899 and CVE-2026-68490) - affected v120 or later. Patched:

• 11.134.0.57 or later
• 11.136.0.41 or later
• 11.138.0.8 or later
• WP Squared: 11.138.1.11 or later

cPanel listed no patched builds for 120-132 in that advisory. If you are still on those lines, do not invent a floor - ask WebPros / move to a listed current line.

WP Toolkit (CVE-2026-87900) is a separate package. Affected: 6.11.2-10794 and older. Fixed: 6.11.3 or later. upcp does not bump this.

The Hacker News (23 Sep 2026) notes WP Toolkit also ships for Plesk, and cPanel has not said whether the Plesk build is in -87900. Unverified either way until Plesk publishes.

Exploitation Status, Labeled

• Vendor advisories: none of the three mention in-the-wild use, a public PoC, or an IoC. The Hacker News, checking 23 Sep 2026, said the same.
• CISA KEV JSON we pulled this morning: catalog 2026.09.25, 1726 entries, dateReleased 2026-09-25T18:58:16Z. CVE-2026-87899, CVE-2026-87900, and CVE-2026-68490 are not in it. WordPress CVE-2026-87902 is in that catalog (dateAdded 2026-09-25). Do not mix the two 8790x numbers.
• Ransomware: no KEV field because they are not in KEV. Do not write "ransomware."
• Preconditions (vendor): for -87899, cPanel lists an authenticated cPanel account. The Hacker News restates that as no extra requirements. We did not independently verify a second gate (mail package, CalDAV enabled, etc.). Assume any paying shared-hosting account until the vendor says otherwise.
• Mechanism: unpublished. CWE-250 plus CalDAV/CardDAV is consistent with a privileged service acting on tenant input. That is reading the CWE, not a reconstructed exploit. We are not publishing a how.

Why Shared Hosting Cares

On a multi-tenant box, PR:L is the product. A customer, a popped WordPress, a phished cPanel password - any of those is "an authenticated cPanel account holder." Root on that host is every other tenant's files, DBs, mail, and SSL keys.

-87899 is the one that ends the isolation promise. -68490 is a cross-tenant read of calendars/contacts (phishing fuel, not root). -87900 is a different package that still has to be bumped or you leave a cross-account database bug on the same servers you just upcp'd.

This is the same September panel-plane streak as LiteSpeed Enterprise before 6.3.7 and Acronis CVE-2026-87886 (that one is KEV). Separate CVEs. Separate packages. Separate greps.

What to Do Now

1. Inventory

/usr/local/cpanel/cpanel -V

Compare against 11.134.0.57 / 11.136.0.41 / 11.138.0.8 / WP2 11.138.1.11. If the string is below the floor for your line, you are in the advisory's affected range.

WP Toolkit (only if installed):

rpm -q wp-toolkit-cpanel 2>/dev/null || dpkg -l wp-toolkit-cpanel 2>/dev/null

Anything 6.11.2-10794 or older is the -87900 range. If the package is absent, stop - do not install WP Toolkit to "check."

Fleet:

for h in $(cat hosts.txt); do
  ssh root@$h '/usr/local/cpanel/cpanel -V 2>/dev/null; rpm -q wp-toolkit-cpanel 2>/dev/null' | sed "s|^|$h: |"
done

2. Patch cPanel & WHM - vendor path

WHM: Home → cPanel → Upgrade to Latest Version, or as root:

/usr/local/cpanel/scripts/upcp --force

That is the cPanel update article path The Hacker News cites for -87899/-68490. Re-run cpanel -V and confirm you are on a listed patched build, not merely that upcp exited 0.

The -68490 advisory says this update corrects permissions for new calendar/address-book storage and repairs existing accounts. That is a behavior of the patch, not a hunting script.

3. Patch WP Toolkit separately

Vendor command from the -87900 advisory, quoted as they published it:

bash <(curl https://wp-toolkit.plesk.com/cPanel/installer.sh || wget -O - https://wp-toolkit.plesk.com/cPanel/installer.sh) --version 6.11.3

That is a vendor installer over HTTPS. Pin --version 6.11.3 as they did. Confirm the installed build is ≥ 6.11.3 afterward. Whether automatic updates will land 6.11.3 is not stated in the advisory.

4. If you cannot patch today

cPanel published no workaround for -87899 or -68490. Restricting who has a cPanel login shrinks PR:L. It does not fix CWE-250. Do not disable CalDAV as a substitute unless WebPros documents that - they did not.

After You Patched

None of the three advisories give a way to tell whether a box was hit before the bump. Absence of a grep is not "clean."

Look for unexplained root activity (new crons, users, SSH keys, unexpected cpdavd/calendar-store permission flips). That is generic host hygiene, not a vendor IoC list - they did not publish one.

What We Don't Know Yet

• The CalDAV/CardDAV code path. Vendor held it. Do not chmod-hunt .caldav trees as a patch.
• In-the-wild use. Not claimed. Not in KEV as of catalog 2026.09.25.
• Whether 120-132 have a hotfix. Not listed. Don't guess a backport.
• Plesk WP Toolkit and -87900. Unverified.
• Vendor vs CNA wording on -87900. Database modifications (cPanel) vs file-read + cross-account code execution (NVD). We are not picking a winner.

Primary sources: cPanel CVE-2026-87899, CVE-2026-68490, CVE-2026-87900, NVD CVE-2026-87899, NVD CVE-2026-87900, NVD CVE-2026-68490, CISA KEV JSON (catalog 2026.09.25), The Hacker News 23 Sep 2026.