New cPanel Critical Flaw Could Let Hosting Customers Run SQL as Database Root
Summary: cPanel patched CVE-2026-58048, a CVSS 9.4 privilege escalation in its database-renaming process that lets an authenticated hosting customer with MySQL/MariaDB access run SQL in the database's root context, affecting all supported versions of cPanel & WHM and WP Squared. The same release closed CVE-2026-58047, an HTTP request-smuggling flaw in cpsrvd rated 5.6, and addressed two Exim issues, including GCVE-25-2026-07-45-3, fixed in Exim 4.99.5.
What you should know: CISA's August 4 enrichment rated the flaw's technical impact as total and recorded no exploitation, but that is a snapshot, and the population able to reach it is set by who holds accounts on the box - a server selling accounts to strangers is a different proposition from one whose accounts all belong to a single company.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-58047CVE-2026-58048
- Related