cPanel CVE-2026-105476 and 105475: root file write, data leak

cPanel published two security notices dated 20 October 2026. The CVE records followed on 2 November. CVE-2026-105476 lets an authenticated user write arbitrary root-owned files and escalate privileges. CVE-2026-105475 lets a remote attacker with no login read the calendar and contact data of any mail account on the server. Both affect every supported branch, including 110 LTS, and the same builds fix both.

CVE-2026-105475 is the second calendar and contacts leak in two months. It follows the CalDAV/CardDAV root escalation, CVE-2026-87899. Builds that fixed that one do not fix these. If you patched in late September and then pinned the version, you are exposed again.

The two CVEs

CVE-2026-105476 is the more serious of the two on shared hosting. On a server where customers hold cPanel logins, one account can write files as root, and that usually leads to full control of the server. CVE-2026-105475 is read-only, but it needs no credentials. Leaked address books and calendars give an attacker good material for phishing your customers' contacts.

cPanel's advisory titles call them "Arbitrary File Write as Root" and "Unauthenticated Access to Calendar and Contact Data". The public records do not name the affected service or give technical detail beyond that.

Affected and fixed builds

All builds below these versions are affected:

Any later build on the same branch also includes the fixes. The CVE records list no WP Squared build. Servers on an end-of-life branch, such as 126, get no fix. Move them to a supported branch first, as covered in cPanel update tiers explained.

Check and patch

Run as root:

/usr/local/cpanel/cpanel -V
grep -E '^(CPANEL|UPDATES)=' /etc/cpupdate.conf

Compare the full build number with the table, not just the branch. A server on 11.138.0.11, the TSR-2026-09-29 fix level, is still vulnerable. If UPDATES=never or CPANEL= is pinned to a specific version, change it in WHM » Server Configuration » Update Preferences, then force the update:

/usr/local/cpanel/scripts/upcp --force
/usr/local/cpanel/cpanel -V
tail -n 50 /var/cpanel/updatelogs/last

If upcp stops on a blocker, work through fixing cPanel update failures rather than re-running it in a loop.

Exploitation status

At publication, neither CVE was in CISA's Known Exploited Vulnerabilities catalogue. CISA's assessment on 2 November recorded no known exploitation and no public proof of concept. HackerOne was the CNA. CVE-2026-105475 is credited to rz1027, the same researcher behind the September CalDAV findings. CVE-2026-105476 is credited to Boomerang.

If a server ran an affected build with untrusted accounts, check it for signs of misuse. Look for unexpected root-owned files in user-writable paths, new cron entries, and SSH keys you did not add. The post-incident checklist from the EmailTrack root flaw applies here unchanged.

upcp can only fetch these builds while the server's cPanel license is active. A lapsed license leaves the server on the vulnerable version.

Next steps

• CVE-2026-87899: the CalDAV/CardDAV root escalation
• cPanel TSR-2026-09-29: three WHM vulnerabilities
• Live patching for hosting fleets: reduce kernel reboots while you keep cPanel itself current.