Multiple cPanel & WHM Vulnerabilities Enable Root Code Execution and Admin Session Hijacking

CVE-2026-93698 is a 9.9-rated operating-system command-injection weakness (CWE-78) in the cPanel Multilang adminbin that turns a basic hosting account into server-wide root execution. The Multilang adminbin is a privileged helper that runs with root-level privileges to perform actions on behalf of unprivileged accounts; the flaw lets any low-privileged tenant inject arbitrary commands through it. cPanel included the fix in the cPanel and WHM update dated September 29, 2026, alongside two lower-severity scripting issues, and the events confirm that all supported versions before that build are affected. The backfill from Suriq's Jack (published October 2, 2026 at 06:52 UTC) confirms the same mechanism and advises that every account on an unpatched box should be considered able to reach the vulnerability.

A successful attack does not stay inside a single tenant; it collapses hosting isolation and gives the attacker root on the server underneath. The story carries a 5.0 score with severity and velocity both at 1.0, which aligns with the 9.9 CVSS and the broad exposure of any cPanel server running builds before September 29, 2026. This is not a routine patch-cycle item: the event list explicitly links CVE-2026-93698 to both root code execution and WHM administrator session hijacking, meaning a single compromised account can escalate to full server control. The combination of a privileged adminbin, no special access required, and universal version exposure makes this one of the highest-impact hosting-flaws in the current cycle.

Defenders should upgrade to the patched builds released September 29, 2026, and treat every hosting account on any unpatched server as a potential attacker path. There is no mention of a network-level workaround in the events; the precise remediation is the vendor build update. For hunting, focus on unexpected root-level command execution originating from the Multilang adminbin context, review adminbin invocation logs for anomalous argument patterns, and compare server timelines against the September 29, 2026 patch date to identify exposure windows.

Watch for any CISA KEV entry for CVE-2026-93698, additional vendor advisories expanding the affected version list, or confirmed exploitation telemetry from hosting providers. Also watch whether the two lower-severity scripting issues mentioned in the same update receive separate CVEs, since the event list currently tracks only CVE-2026-93698.