CVE-2026-93698: cPanel Multilang adminbin is account-to-root - patch 11.138.0.11

The Situation

On 29 September 2026 WebPros shipped a Targeted Security Release on every supported cPanel & WHM train. On 2 October the matching CVE records went public.

The one that matters on a shared box is CVE-2026-93698:

• CWE-78 OS command injection in the Multilang adminbin.
• Vendor one-liner: "Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin."
• CVSS 3.0 9.9 CRITICAL - AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (HackerOne / WebPros).
• Impact, in the vendor's words: successful exploitation leads to code execution as root, with full control of the server and every account, website, and database on it.

Same build also closes CVE-2026-93697, a stored XSS in WHM's Mass Modify Accounts UI (CVSS 3.0 9.0, UI:R). An unprivileged account holder can store script that runs in a WHM administrator's session. Patch once, both go away.

Finder credit on both records: rz1027. HackerOne reports 4054291 and 4047787 are listed; they are not public write-ups.

Primary sources:

• cPanel advisory - CVE-2026-93698 (29 Sep 2026)
• cPanel advisory - CVE-2026-93697
• CVE-2026-93698 / CVE list JSON
• CVE-2026-93697
• Changelogs: 138.0.11 · 136.0.45 · 134.0.61 · 110.0.148

Version floors

cPanel's advisory says all supported versions are affected until you hit these builds or later:

• CURRENT 138: 11.138.0.11 (changelog date 2026-09-29, line item: [Security] Targeted Security Release)
• 136: 11.136.0.45 (same date, same one-line TSR)
• 134: 11.134.0.61
• LTS 110: 11.110.0.148
• WP Squared: 11.138.1.13 (vendor advisory + CVE list; see honesty section)

CVE list encoding is lessThan those versions, defaultStatus: unaffected - so the floor is inclusive of the listed build.

Check what you actually run:

/usr/local/cpanel/cpanel -V

Anything below the floor for your train is still open. Do not assume "we took last week's upcp" without reading the build number - 138.0.10 (23 Sep) is below 138.0.11.

Why this is a shared-hosting problem

PR:L means this is not unauthenticated internet RCE. It is an authenticated, low-privilege caller. On cPanel that is every paying tenant, every compromised WordPress, every reseller child account that can reach the code path.

cPanel adminbins are the privileged helpers the unprivileged UI talks to. The vendor did not publish the argument, the binary path, or a patch diff - so this post will not invent them. What they did publish is the outcome: root on the box, scope changed (S:C), which is the CVSS way of saying the blast radius leaves the vulnerable component.

Treat it as tenant-to-root until you have patched. CageFS, CloudLinux LVE, and open_basedir do not get a mention in the advisory as mitigations. Do not wait for a "disable Multilang" tweak that WebPros did not document.

The sibling XSS is the social-engineering twin: the tenant plants HTML, a WHM admin opens Mass Modify Accounts, the admin's session does the rest. Same TSR.

Patch

Vendor call to action is the stock updater.

Command line, as root:

/usr/local/cpanel/scripts/upcp --force
/usr/local/cpanel/cpanel -V

Or WHM: Home → cPanel → Upgrade to Latest Version → Click to Upgrade.

Confirm you landed on or above the floor for your major, not merely "an update ran." If you pin a major (110 LTS vs CURRENT), pin does not block the TSR on that train - it just means 110 hosts need 11.110.0.148+, not a jump to 138.

WP Squared hosts: advisory floor is 11.138.1.13. Update through the WP Squared updater, then verify the installed version on the box.

No workaround is listed. The upgrade is the mitigation.

Honesty / what we are not claiming

This section exists so nobody pastes the CVSS into a customer ticket as if it were a KEV.

Vendor-reported (treat as vendor claims, not our lab):

• Command injection via Multilang adminbin; impact = root; all supported cPanel/WHM versions until the floors above.
• Stored XSS in WHM Mass Modify Accounts; unprivileged account → admin session.
• CVSS 9.9 / 9.0 and the vectors above come from the HackerOne CNA record, not from NVD as a primary metric. NVD had the 93698 record on 3 Oct 2026 with vulnStatus: Deferred and the same vendor vector as Secondary.
• Changelog entries for 138.0.11 / 136.0.45 / 134.0.61 / 110.0.148 are only [Security] Targeted Security Release - no CVE IDs in the changelog. The CVE↔build mapping is the security advisory, not the changelog prose.

Unverified / not claimed:

• Not in CISA KEV. Catalog version 2026.10.02 (dateReleased 2026-10-02T15:19:38Z, 1733 entries) does not list CVE-2026-93698 or CVE-2026-93697. Newest KEV that day was Zammad, not cPanel. Absence from KEV is not proof of non-exploitation.
• CISA ADP SSVC on the CVE JSON (updated 2026-10-02T18:14:48Z): Exploitation: none, Automatable: no, Technical Impact: total. That is CISA's enrichment at publication, not a guarantee it stays that way.
• No public proof-of-concept is cited in the CVE record. We did not reproduce the bug. This post contains no payload, no adminbin argv, no request shape.
• We have not seen a patch diff, so any story about which Multilang argument is unsanitized is speculation. Skip it.
• WP Squared 11.138.1.13: listed by the cPanel advisory and the CVE affected block. The public WP Squared changelog page, fetched 3 Oct 2026, still showed 138.1.12 as the newest 2026-09 heading and did not contain the string 138.1.13. Operators should trust cpanel -V / the WP Squared version on the server, not the docs TOC.
• We are not claiming mass in-the-wild exploitation. We are claiming the vendor published a 9.9 tenant-to-root with a patch that is four days old, on the panel most of the shared fleet still runs.

After you patch

1. Record pre/post cpanel -V in the change ticket.
2. If the box was below the floor and you have untrusted tenants (you do), this is a compromise-assessment question, not only a patch question. Look for unexpected root-owned files in tenant homes, new WHM API tokens, extra ssh keys in /root/.ssh/authorized_keys, and WHM account modifications you did not make. None of those are CVE-specific IOCs - WebPros did not publish any.
3. Do not roll back across 138.0.11 / 136.0.45 / 134.0.61 / 110.0.148. Adjacent changelog lines on 23 Sep already warn that reverting a security-hardening build removes those improvements; a TSR is the same class of change.

If you would rather not be the person who discovers the adminbin the hard way, this is the class of panel CVE we patch on managed cPanel before the CVE tweet lands. Managed cPanel · contact.