Multiple cPanel & WHM Vulnerabilities Enable Root Code Execution and Admin Session Hijacking

cPanel released security updates addressing three vulnerabilities in cPanel & WHM: a critical Multilang adminbin arbitrary command-execution flaw (CVE-2026-93698, CVSS 9.9) that can lead to root-level code execution, and two stored XSS vulnerabilities in WHM admin interfaces (CVE-2026-93029 and CVE-2026-93697) that could allow session hijacking and privileged actions. Administrators are urged to upgrade to the fixed versions, review logs for signs of compromise, restrict WHM access, and enforce MFA while applying patches.