Multiple cPanel & WHM Vulnerabilities Enable Root Code Execution and Admin Session Hijacking

cPanel released advisories for multiple severe vulnerabilities affecting supported cPanel & WHM versions: CVE-2026-93698 (insufficient input validation in Multilang adminbin allowing arbitrary command execution as root) and two stored XSS flaws (CVE-2026-93029, CVE-2026-93697) that can execute in a WHM administrator’s session and lead to privilege abuse. Administrators are urged to upgrade to the patched builds listed (various 11.x versions) and apply interim mitigations such as restricting WHM access, enforcing MFA, and reviewing privileged activity.