Skip to navigation

Threat reportVulnerabilityTL-2026-2636

cPanel/WHM CalDAV/CardDAV and WP Toolkit Flaws Enable Cross-Account Access and Root Privilege Escalation (CVE-2026-68490, CVE-2026-87899, CVE-2026-87900)

criticalMONITORING

On September 22, 2026 cPanel fixed three tenant-isolation flaws affecting shared-hosting servers running cPanel & WHM 120 and later: a CalDAV/CardDAV privilege escalation that lets any authenticated cPanel account holder execute code as root (CVE-2026-87899, CVSS 4.0 9.4), an incorrect-permission flaw exposing other accounts' calendars and contacts to local users (CVE-2026-68490, CVSS 4.0 8.2), and an argument injection in WP Toolkit for cPanel <= 6.11.2-10794 that lets logged-in users modify other accounts' databases and, per the CVE record, read arbitrary …

Key facts

IdentifiersTL-2026-2636, CVE-2026-68490, CVE-2026-87899, CVE-2026-87900, CVE-2026-29205
SeverityCRITICAL
CVSS9.4 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)
EPSSCVE-2026-87900: 0.6% (47.8th percentile); CVE-2026-87899: 0.5% (45.7th percentile); CVE-2026-29205: 0.4% (33.3th percentile)
Affected productscPanel (WebPros) cPanel & WHM (CalDAV/CardDAV - cpdavd); cPanel (WebPros) WP Squared; WebPros WP Toolkit for cPanel
Weaknesses (CWE)CWE-732, CWE-250, CWE-88
MITRE ATT&CK techniquesT1005 Data from Local System, T1059 Command and Scripting Interpreter, T1078 Valid Accounts, T1078.003 Local Accounts, T1114.001 Local Email Collection, T1190 Exploit Public-Facing Application, T1552.001 Credentials In Files, T1565.001 Stored Data Manipulation, T1566 Phishing, T1589.002 Email Addresses, T1591.002 Business Relationships
MotivationUNKNOWN
Target sectorsweb hosting, technology
Target regionsGlobal
Detection rules9 (1 shown free)
Sources18 cited sources

Detection coverage

As of 2026-09-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2636 across Splunk SPL, Microsoft KQL and Sigma, covering 5 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: cPanel cpdavd Spawning Shell, Interpreter or Download Tool (CVE-2026-87899 Root Code Execution) — Exploitation

Detects the cPanel CalDAV/CardDAV daemon (cpdavd, listening on 2079/2080 and running as root) spawning a shell, scripting interpreter, network/download utility or account/persistence utility. CVE-2026-87899 (CWE-250, CVSS 4.0 9.4) lets any authenticated cPanel account holder abuse privileged CalDAV/CardDAV background tasks that fail to sanitize user input and execute code as root. cpdavd is a request-serving daemon and has no legitimate reason to launch sh/bash/python/curl/nc style children, so this process lineage is a high-fidelity indicator of exploitation on unpatched builds (11.120.0.0-11.134.0.56, 11.136.0.0-11.136.0.40, 11.138.0.0-11.138.0.7). Root-owned children are escalated to critical.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1068, T1059, T1078.003
  • Data sources: sysmon_for_linux, mde_linux_DeviceProcessEvents, linux_process_creation
  • Severity: critical
  • Confidence: high

Splunk SPL

```CVE-2026-87899: cpdavd (root CalDAV/CardDAV daemon) should never spawn shells, interpreters or download tools```
index=linux sourcetype="sysmon:linux" EventID=1 earliest=-24h (ParentImage="*cpdavd*" OR ParentCommandLine="*cpdavd*") Image IN ("*/sh","*/bash","*/dash","*/zsh","*/ksh","*/perl","*/python*","*/php*","*/ruby","*/curl","*/wget","*/nc","*/ncat","*/socat","*/base64","*/busybox","*/crontab","*/useradd","*/chmod")
| eval run_as_root=if(User=="root" OR User=="0", "yes", "no")
| stats count min(_time) as first_seen max(_time) as last_seen values(Image) as child_images values(CommandLine) as child_cmdlines values(User) as child_users values(run_as_root) as run_as_root by host ParentImage ParentProcessId
| eval cve="CVE-2026-87899", severity=if(run_as_root=="yes", "critical", "high")
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen host ParentImage ParentProcessId child_images child_cmdlines child_users run_as_root severity cve count

Microsoft KQL

// CVE-2026-87899 - cpdavd (root CalDAV/CardDAV daemon) spawning shells, interpreters or download tools
let suspicious_children = dynamic(['sh','bash','dash','zsh','ksh','perl','python','python3','php','ruby','curl','wget','nc','ncat','socat','base64','busybox','crontab','useradd','chmod']);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName contains 'cpdavd' or InitiatingProcessCommandLine contains 'cpdavd'
| where FileName in~ (suspicious_children)
| extend RunAsRoot = AccountName =~ 'root', Cve = 'CVE-2026-87899'
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, FileName, ProcessCommandLine, AccountName, RunAsRoot, SHA256, Cve
| order by Timestamp desc

Sigma

title: cPanel cpdavd Spawning Shell or Interpreter Child Process (CVE-2026-87899)
id: 3b7e1c52-9f4a-4d2e-8a61-0c5d7e2f9a13
status: experimental
description: Detects the root-privileged cPanel CalDAV/CardDAV daemon cpdavd spawning a shell, interpreter, download or account utility, indicative of CVE-2026-87899 exploitation by an authenticated cPanel account.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87899
  - https://support.cpanel.net/hc/en-us/articles/43591715125271
  - https://thehackernews.com/2026/09/new-cpanel-flaw-lets-hosting-account_0272795595.html
author: Threadlinqs Team
date: 2026-09-24
tags:
  - attack.privilege-escalation
  - attack.t1068
  - attack.execution
  - attack.t1059
  - attack.t1078.003
  - cve.2026-87899
logsource:
  product: linux
  category: process_creation
detection:
  selection_parent:
    - ParentImage|contains: 'cpdavd'
    - ParentCommandLine|contains: 'cpdavd'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/ksh'
      - '/perl'
      - '/python'
      - '/python3'
      - '/php'
      - '/ruby'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/socat'
      - '/base64'
      - '/busybox'
      - '/crontab'
      - '/useradd'
      - '/chmod'
  condition: selection_parent and selection_child
falsepositives:
  - cPanel maintenance or upgrade (upcp) activity that restarts cpdavd through a wrapper shell
level: critical

Known false positives:

  • cPanel upcp / restartsrv_cpdavd maintenance that launches cpdavd through a wrapper shell, making the shell appear as a cpdavd-related process
  • Vendor support staff running diagnostics that exec helpers from the cpdavd context

Tuning notes: Baseline cpdavd children over 7 days on patched hosts and allowlist any cPanel-shipped helper under /usr/local/cpanel/ by full path and hash instead of by name. Do not exclude perl wholesale: attackers can exec cPanel's own perl with -e. Treat any hit on an unpatched build (cpanel -V below 11.134.0.57 / 11.136.0.41 / 11.138.0.8) as an incident.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • CalDAV/CardDAV Session to cpdavd (2079/2080) Followed by cpdavd Child Process (CVE-2026-87899) — Exploitation · unlock with TL Creds
  • Root Persistence or Account Tampering by cpdavd / WP Toolkit Process Tree (CVE-2026-87899 / CVE-2026-87900) — Post-Exploitation · unlock with TL Creds
  • Outbound C2 or Tool Staging from cpdavd / WP Toolkit Process Tree on cPanel Host — Command and Control · unlock with TL Creds
  • WP Toolkit for cPanel Database Command Argument Injection (CVE-2026-87900) — Exploitation · unlock with TL Creds
  • cpdavd or WP Toolkit Writing Root Persistence or Account Files — Post-Exploitation · unlock with TL Creds
  • Cross-Tenant Harvesting of CalDAV, Mail, WordPress and DB Credential Files on cPanel Host — Collection / Lateral Movement · unlock with TL Creds
  • Cross-Account Read of cPanel CalDAV/CardDAV Storage ($homedir/.caldav) (CVE-2026-68490) — Post-Exploitation · unlock with TL Creds
  • Cross-Account MariaDB/MySQL Database Tampering on cPanel Host via WP Toolkit (CVE-2026-87900) — Lateral Movement · unlock with TL Creds

Indicators of compromise

As of 2026-09-23, Threadlinqs Intelligence tracks 5 indicators of compromise for TL-2026-2636.

5 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

On September 22, 2026 cPanel fixed three tenant-isolation flaws affecting shared-hosting servers running cPanel & WHM 120 and later: a CalDAV/CardDAV privilege escalation that lets any authenticated cPanel account holder execute code as root (CVE-2026-87899, CVSS 4.0 9.4), an incorrect-permission flaw exposing other accounts' calendars and contacts to local users (CVE-2026-68490, CVSS 4.0 8.2), and an argument injection in WP Toolkit for cPanel <= 6.11.2-10794 that lets logged-in users modify other accounts' databases and, per the CVE record, read arbitrary files and execute code across customer accounts (CVE-2026-87900, CVSS 4.0 9.4). No in-the-wild exploitation or public PoC has been reported; fixes are in cPanel & WHM 11.134.0.57, 11.136.0.41, 11.138.0.8, WP Squared 11.138.1.11 and WP Toolkit 6.11.3.

On September 22, 2026, cPanel (WebPros) published a security release addressing three vulnerabilities that break tenant isolation on multi-tenant shared-hosting servers. Two of the flaws are in cPanel's CalDAV/CardDAV functionality, which is served by the cpdavd daemon (ports 2079/TCP plain and 2080/TCP SSL). cpdavd runs with root privileges and stores per-account calendar and address-book data under the account home directory ($homedir/.caldav/<principal>/<collection>/). The third flaw is in WebPros' WP Toolkit plugin for cPanel. All three CVE records were published to NVD on September 23, 2026 with CVSS 4.0 scores.

CVE-2026-87899 (CWE-250, Execution with Unnecessary Privileges; CVSS 4.0 9.4, AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) is the most severe. According to the NVD description, it "allows remote authenticated users to execute arbitrary code with root privileges." Secondary reporting (SecurityOnline) attributes the flaw to privileged CalDAV/CardDAV background tasks that fail to sanitize user-controlled input. The only precondition is a valid cPanel account - no additional privilege or mail package is required - so on a shared server any single compromised or malicious customer account can be escalated to root, yielding control of the host and every other account on it. Per post-disclosure analysis (Blogspan), root on a shared cPanel host means access to every customer account, the ability to modify or delete hosted websites, access to all customer mailboxes and credentials, and the ability to install persistent backdoors. The CVE record lists affected builds 11.120.0.0-11.134.0.56, 11.136.0.0-11.136.0.40 and 11.138.0.0-11.138.0.7; no temporary mitigation was provided. HackerOne is the CNA for all three CVEs.

CVE-2026-68490 (CWE-732, Incorrect Permission Assignment for Critical Resource; CVSS 4.0 8.2, AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N) stems from incorrect permissions on CalDAV/CardDAV storage, allowing a local user on the same server to read calendar events and contacts belonging to other cPanel accounts. Exposure is read-only (no modification, no privilege escalation), but the leaked names, email addresses, business relationships and meeting schedules are directly useful for targeted phishing and social engineering. The fix corrects permissions for newly created calendar/address-book storage and repairs unsafe permissions on existing accounts. The issue was reported by researcher Ali Mustafa (rz1027), who is credited with at least seven cPanel and Plesk flaws disclosed since August 27, 2026.

CVE-2026-87900 (CWE-88, Argument Injection; CVSS 4.0 9.4) affects database-creation command handling in WP Toolkit for cPanel versions 6.11.2-10794 and earlier. The vendor advisory describes a logged-in cPanel user being able to modify databases owned by other accounts; the CVE/NVD record goes further, stating the argument injection "allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts." The CVE record lists 6.11.3-10850 as the first unaffected build and also credits Ali Mustafa (rz1027); The Hacker News reports he is credited with all three flaws. WP Toolkit ships and updates separately from cPanel, so upcp alone does not fix it - it must be upgraded to 6.11.3 or later with the WP Toolkit installer.

Context: this release lands during a heavy run of cPanel ecosystem vulnerabilities in 2026. CVE-2026-41940 (authentication bypass, CVSS 9.8) was exploited from late February 2026 until its April 28 patch and used to deploy the Go-based "Sorry" Linux ransomware against at least 44,000 cPanel IPs; cpdavd itself previously carried CVE-2026-29205, a pre-auth arbitrary root file read in its CalDAV attachment handler (fixed May 13, 2026). September 2026 also saw an EmailTrack SQL injection (CVE-2026-67401), a ConfigServer Security & Firewall flaw (CVE-2026-65638), a domain-parking flaw (CVE-2026-65643) and several Plesk issues. As of September 23, 2026, none of the three CVEs is in CISA KEV, and no in-the-wild exploitation, public PoC or IOCs have been reported. Given how quickly attackers weaponized earlier cPanel flaws, administrators should patch immediately and review account, database, calendar and address-book activity for unexplained cross-account access.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1114.001 Local Email Collection

Execution

T1059 Command and Scripting Interpreter

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1566 Phishing

Privilege Escalation

T1078.003 Local Accounts

Credential Access

T1552.001 Credentials In Files

Impact

T1565.001 Stored Data Manipulation

Reconnaissance

T1589.002 Email Addresses; T1591.002 Business Relationships

Remediation

Patches

  • cPanel & WHM 11.134.0.57
  • cPanel & WHM 11.136.0.41
  • cPanel & WHM 11.138.0.8
  • WP Squared 11.138.1.11
  • WP Toolkit for cPanel 6.11.3

Immediate actions

  • Upgrade cPanel & WHM to 11.134.0.57, 11.136.0.41, 11.138.0.8 or later (WP Squared 11.138.1.11 or later) via WHM Home / cPanel / Upgrade to Latest Version, or run /usr/local/cpanel/scripts/upcp --force as root
  • Upgrade WP Toolkit for cPanel separately to 6.11.3 or later: bash <(curl https://wp-toolkit.plesk.com/cPanel/installer.sh || wget -O - https://wp-toolkit.plesk.com/cPanel/installer.sh) --version 6.11.3
  • Confirm installed versions after upgrading (/usr/local/cpanel/cpanel -V for cPanel & WHM; WP Toolkit package version must be 6.11.3 or later)
  • Prioritize public multi-tenant shared-hosting servers, where any single customer account is a viable root-escalation foothold

Workarounds

  • No temporary mitigation was published for CVE-2026-68490 or CVE-2026-87899; patching is the only vendor-supported fix
  • Where calendar/contacts are not required, restricting access to cpdavd ports 2079/2080 reduces exposure but is not a vendor-documented mitigation

Longer-term hardening

  • Review account, database, calendar and address-book activity for unexplained cross-account access or database changes
  • Audit permissions on per-account CalDAV/CardDAV storage ($homedir/.caldav) for cross-account readability
  • Keep cPanel automatic updates enabled and track cPanel/WebPros security advisories given the high 2026 cadence of cPanel ecosystem flaws
  • Monitor for unexpected root-owned child processes spawned by cpdavd and for anomalous WP Toolkit database-creation operations

Affected and fixed versions

  • cPanel (WebPros) — cPanel & WHM (CalDAV/CardDAV - cpdavd)
    Vulnerable versions: 120 and later prior to fixed builds
    Fixed in: 11.134.0.57; 11.136.0.41; 11.138.0.8
  • cPanel (WebPros) — WP Squared
    Vulnerable versions: builds prior to 11.138.1.11
    Fixed in: 11.138.1.11
  • WebPros — WP Toolkit for cPanel
    Vulnerable versions: <= 6.11.2-10794
    Fixed in: 6.11.3-10850

Timeline

  • cPanel patched CVE-2026-41940 (auth bypass, CVSS 9.8), exploited since late February 2026 to deploy 'Sorry' Linux ransomware on at least 44,000 cPanel IPs - context for how fast cPanel flaws get weaponized
  • cPanel shipped a fix for CVE-2026-29205, a pre-auth arbitrary root file read in the same cpdavd CalDAV daemon (publicly detailed by Searchlight Cyber on May 18, 2026)
  • First of at least seven cPanel and Plesk flaws credited to researcher Ali Mustafa (rz1027) is disclosed, starting a series that includes CVE-2026-68490
  • Related cPanel EmailTrack SQL injection flaw (CVE-2026-67401) disclosed
  • Several related Plesk flaws disclosed
  • cPanel published advisories and fixed builds for CVE-2026-68490 and CVE-2026-87899 (cPanel & WHM 11.134.0.57, 11.136.0.41, 11.138.0.8; WP Squared 11.138.1.11) and CVE-2026-87900 (WP Toolkit 6.11.3)
  • Cyber Security News, The Hacker News and others reported the flaws; none were in CISA KEV and no in-the-wild exploitation or public PoC was reported
  • CVE records published to NVD with CVSS 4.0 scores: CVE-2026-87899 9.4 (CWE-250), CVE-2026-87900 9.4 (CWE-88), CVE-2026-68490 8.2 (CWE-732)

Sources cited

Showing 15 of 18 sources, primary sources first.

Previous and next in vulnerability

Drafted by the Threadlinqs research pipeline from 18 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats