CVE-2026-58048: cPanel SQL Root Privilege Escalation (August 2026)

CVE-2026-58048 — cPanel SQL Root Privilege Escalation

CVE-2026-58048 is a critical vulnerability in cPanel (severity: critical) that allows authenticated hosting customers to execute arbitrary SQL commands as the database root user. This flaw enables privilege escalation beyond normal boundaries, with the potential for full database and operating system compromise. No evidence of active exploitation has been reported, but the risk profile is severe.

Attack Vector

Attackers must have authenticated access to a hosting account on a vulnerable cPanel server. By leveraging the flaw, they can escalate their database privileges to root, bypassing standard access controls. This enables execution of any SQL command, including those that can manipulate or exfiltrate sensitive data, create new administrative users, or pivot to underlying OS-level access. Related vulnerabilities include an HTTP request smuggling issue and Exim local privilege escalation, increasing the attack surface for lateral movement and credential theft.

Who Is at Risk

All organizations running affected versions of cPanel, including hosting providers and customers using WP Squared, are at risk. Multi-tenant shared hosting environments are especially vulnerable, as any authenticated user could exploit the flaw to compromise other tenants or the server itself. The impact is global, with no region-specific limitations.

Patch & Mitigate

• Patch: Apply the latest cPanel security updates released after discovery of CVE-2026-58048. Patch immediately—delays increase risk of compromise.
• Workaround: No reliable workaround is available. Restrict authenticated user access where possible until patched.
• Detect: Monitor database logs for anomalous privilege escalations or unexpected root-level SQL activity. Review server logs for signs of lateral movement or privilege escalation attempts.

MITRE ATT&CK

• TA0004 — Privilege Escalation: Attackers use the flaw to gain root-level database access, exceeding intended privileges.
• T1078 — Valid Accounts: Exploitation requires an authenticated account on the target cPanel server.
• T1040 — Network Sniffing: Related HTTP request smuggling vulnerabilities could be leveraged for credential interception.

Source: https://thehackernews.com/2026/08/new-cpanel-critical-flaw-could-let.html