cPanel support advisory (22 September 2026) documents CVE-2026-87899: an authenticated cPanel account holder can escalate through CalDAV/CardDAV functionality to code execution as root and full server control. Affects cPanel/WHM v120 or later; patched in 11.134.0.57+, 11.136.0.41+, 11.138.0.8+, and WP Squared 11.138.1.11+. Same-day related advisories (not separate desk cards): CVE-2026-87900 (WP Toolkit ≤6.11.2-10794 — authenticated cPanel user can modify other accounts' databases; fix WP Toolkit 6.11.3+) and CVE-2026-68490 (CalDAV/CardDAV — local user can read other accounts' calendar/contacts; same cPanel/WHM patched trains; no root).

Vendor advisories do not publish CVSS and do not state exploitation. Credited to Ali Mustafa (rz1027). Primary: cPanel support CVE-2026-87899; secondary: The Hacker News 23 Sep 2026.

UPDATE (24 Oct 2026): The CVE record (HackerOne as CNA) scores CVE-2026-87899 at 9.4 under CVSS 4.0 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). (source: CVE record CVE-2026-87899)