CVE-2026-87899: WebPros cPanel

Critical severity, CVSS 9.4. EPSS: 0.6% chance of exploitation in the next 30 days.

Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges.

Affected products

• WebPros cPanel: from 11.120.0.0, before 11.134.0.57 (fixed in 11.134.0.57); from 11.136.0.0, before 11.136.0.41 (fixed in 11.136.0.41); from 11.138.0.0, before 11.138.0.8 (fixed in 11.138.0.8)

Published 2026-09-23. Last modified 2026-09-24.