cPanel July 2026 Security Alert: HTTP Request Smuggling, Exim Privilege Escalation & Database Exploit Patched
What Happened
cPanel released a batch of security advisories in late July 2026 addressing three high-severity vulnerabilities affecting the cPanel & WHM ecosystem. Two are authenticated privilege escalations (Exim and Database), and one is a network-layer attack vector (HTTP Request Smuggling) that allows unauthenticated access to internal services.
All three are patched in the latest cPanel builds. If you manage cPanel servers, this is not a "schedule for next week" situation.
The Three Vulnerabilities
CVE-2026-58047 - HTTP Request Smuggling
Severity: Critical | CVSS: 8.6+
HTTP Request Smuggling occurs when a front-end proxy (like nginx or Apache reverse proxy) and a back-end server disagree about where one HTTP request ends and the next begins. An attacker can "smuggle" a malicious request inside an innocent-looking one, bypassing authentication, poisoning caches, and accessing internal services without credentials.
In cPanel's case, the attack vector involves the web server stack used by cPanel's service subdomains (cpsrvd, webmail, webdisk). A carefully crafted request can reach the backend cPanel daemon as if it came from an authenticated session.
What this means: An attacker on the same network segment (or in a position to route traffic to your cPanel server) can craft requests that bypass login, access internal cPanel APIs, and potentially execute actions as if authenticated.
Affected versions: cPanel & WHM versions 11.108 through 11.118, depending on build tier (STABLE, RELEASE, CURRENT, EDGE).
Fix: Update to the latest build in your tier. The patch adds request boundary validation in the cPanel proxy layer and rejects ambiguous Transfer-Encoding / Content-Length combinations.
GCVE-2026-07-45-3 - Exim Forward Chain Privilege Escalation
Severity: High | CVSS: 7.8
cPanel integrates Exim as its MTA. This vulnerability allows a local authenticated user (like a cPanel account holder) to craft a malicious .forward file that triggers a privilege escalation through the Exim delivery chain. The exploit chains Exim's forward file processing with cPanel's Exim configuration to execute commands as the cPanel user - or potentially as root depending on pipe transport configuration.
What this means: A compromised cPanel account (or a malicious shared hosting customer) can escalate from a standard cPanel user to the cPanel system user, gaining access to other users' mail, files, and configuration.
Affected versions: cPanel & WHM 11.110 and later running Exim 4.97+ with forward file processing enabled.
Fix: The patch applies stricter validation to .forward file content and adds an Exim configuration directive that restricts pipe transport execution to an allowlist of permitted commands.
CVE-2026-58048 - Database Privilege Escalation
Severity: High | CVSS: 8.2
This vulnerability allows a cPanel account holder to escalate MySQL/MariaDB privileges beyond the permissions granted to their user. The attack uses cPanel's internal database management API to create or modify database objects (triggers, stored procedures, DEFINER clauses) in a way that bypasses the MySQL privilege model.
An attacker with a single cPanel database user can potentially:
- Read data from other cPanel accounts' databases on the same MySQL/MariaDB instance
- Modify or drop other users' tables
- Execute arbitrary SQL with elevated privileges
What this means: On a shared MySQL/MariaDB instance (which is the default cPanel configuration), a compromised hosting account can access every database on the server.
Affected versions: cPanel & WHM versions running MySQL 8.0 or MariaDB 10.6+ with the cPanel database map enabled.
Fix: The patch adds database-level permission checks in cPanel's database proxy layer and restricts DEFINER clause manipulation for non-administrative users.
How to Patch
Step 1: Check Your Current Version
# SSH into your cPanel server
/usr/local/cpanel/cpanel -V
Note your version number and build tier.
Step 2: Update cPanel
# Update to the latest build in your tier
/scripts/upcp --force
This updates cPanel, Exim, and the internal database proxy to the patched versions.
Step 3: Update Exim Configuration
Even after the cPanel update, manually verify your Exim configuration:
# Check Exim version
exim -bV
# Verify forward file processing restrictions
grep -r 'allow_pipe' /etc/exim.conf.local 2>/dev/null
grep -r 'forbid_pipe' /etc/exim.conf 2>/dev/null
After the cPanel update, run:
/scripts/buildeximconf
/scripts/restartsrv_exim
Step 4: Restart Services
/scripts/restartsrv_cpsrvd
/scripts/restartsrv_httpd
/scripts/restartsrv_mysql
Step 5: Verify the Patch
# Check cPanel build number
cat /usr/local/cpanel/version
# Verify the build date is after July 26, 2026
stat /usr/local/cpanel/version
# Test HTTP smuggling protection
curl -sI -H 'Transfer-Encoding: chunked' -H 'Content-Length: 0' https://your-server:2083/ 2>&1 | head -3
# Should return 400 Bad Request on patched systems
Temporary Mitigations (If You Cannot Patch Immediately)
If updating immediately is not possible:
For HTTP Request Smuggling
# Add to cPanel's Apache or nginx proxy config:
# Explicitly reject requests with both Transfer-Encoding and Content-Length
echo 'RequestHeader unset Transfer-Encoding' >> /etc/apache2/conf.d/cpanel-smuggling.conf
# For nginx:
echo 'proxy_set_header Transfer-Encoding "";' >> /etc/nginx/conf.d/cpanel-proxy.conf
For Exim Privilege Escalation
# Temporarily disable .forward file processing
echo 'forbid_forward_file' >> /etc/exim.conf.local
/scripts/buildeximconf
/scripts/restartsrv_exim
Warning: This breaks email forwarding for cPanel users. Apply only if you have no other option.
For Database Privilege Escalation
# Restrict DEFINER on existing procedures
mysql -e "SELECT CONCAT('ALTER DEFINER=CURRENT_USER SQL SECURITY INVOKER VIEW ', TABLE_SCHEMA, '.', TABLE_NAME, ';') FROM information_schema.VIEWS WHERE DEFINER NOT IN ('root@localhost', 'cpanel@localhost') AND SECURITY_TYPE = 'DEFINER';" | grep ALTER | mysql
How ServerGurus Handles This
All ServerGurus-managed cPanel servers are updated to the patched builds. Our monitoring has confirmed no exploitation on customer servers. If you are on our managed cPanel hosting:
- The patches were applied on July 27-28, 2026
- Exim configurations were rebuilt with pipe restrictions
- Database privileges were audited for DEFINER anomalies
- No action is needed unless you received a direct notification
Self-managed cPanel customers: run /scripts/upcp --force now. If you need assistance, open a support ticket with subject "cPanel July 2026 CVE Patch."
Quick Checklist
- Run
/scripts/upcp --forceto update cPanel - Rebuild Exim config:
/scripts/buildeximconf - Restart cpsrvd, httpd, and mysql services
- Verify cPanel build number is current (post July 26, 2026)
- Audit database DEFINER clauses for anomalies
- Test HTTP smuggling protection: 400 on conflicting headers
- Check Exim forward file restrictions are active