Critical cPanel Vulnerability Allows Full Database Access via Privilege Escalation

A critical privilege-escalation vulnerability, tracked as CVE-2026-58048, has been disclosed in cPanel & WHM, allowing authenticated users to execute arbitrary SQL commands with full administrative privileges. This flaw affects all supported versions of cPanel & WHM prior to the recent security updates. The vulnerability poses a significant risk of root-level server compromise, particularly in certain configurations. The issue was published on July 31, 2026, with the first public proof of concept released on August 4, 2026. Administrators are urged to apply the latest security updates to mitigate the risk. Affected users include hosting providers and their customers utilizing cPanel & WHM for database management. The potential for exploitation is high, given the nature of the flaw and the broad usage of cPanel in web hosting environments.

Key Points: • CVE-2026-58048 allows privilege escalation to execute SQL commands as an admin. • All supported versions of cPanel & WHM prior to recent updates are vulnerable. • Immediate patching is recommended to prevent potential root-level server compromise.