CVE-2026-87899: cPanel CalDAV/CardDAV flaw gives accounts root

On 22 September 2026 cPanel published three advisories credited to the same researcher, Ali Mustafa (rz1027). The headline is CVE-2026-87899: an authenticated cPanel account holder can escalate privileges through the CalDAV and CardDAV service and execute code as root. The CVE record carries a CVSS 4.0 score of 9.4 and is classed as CWE-250, execution with unnecessary privileges. Two companion flaws shipped the same day: a calendar and contacts data leak (CVE-2026-68490) and a cross-account database bug in WP Toolkit (CVE-2026-87900).

Servers with automatic updates disabled or a pinned version will not have picked up the fix on their own. If you run shared hosting with any account you don't fully trust, this is the same class of risk as the EmailTrack root escalation two weeks earlier: one customer login becomes the whole box.

The three CVEs

CVE-2026-68490 scores 8.2 under CVSS 4.0. cPanel states it does not allow modifying data or gaining root, but address books on a shared server are good raw material for targeted phishing.

Affected and fixed versions

Both CalDAV/CardDAV flaws affect cPanel & WHM 120 and later, the release where the cpdavd service replaced the old Calendar and Contacts Server plugin. The 110 LTS branch predates cpdavd and has no fixed build listed for these CVEs.

WP Toolkit is versioned and updated separately from cPanel. Versions 6.11.2-10794 and older are affected; 6.11.3 is fixed.

Check and patch

/usr/local/cpanel/cpanel -V

If the build is below the fixed version for its branch, update:

/usr/local/cpanel/scripts/upcp --force

If upcp fails partway, follow fixing cPanel update failures rather than re-running it repeatedly. A server on an end-of-life branch gets nothing; move it to a supported tier first, as covered in cPanel update tiers explained.

The update fixes the permissions used for new calendar and address book storage and also repairs permissions on existing accounts, so there is no separate clean-up script to run for CVE-2026-68490.

Then update WP Toolkit with the command from cPanel's advisory:

bash <(curl https://wp-toolkit.plesk.com/cPanel/installer.sh || wget -O - https://wp-toolkit.plesk.com/cPanel/installer.sh) --version 6.11.3

If you can't patch today

cPanel has published no workaround; updating is the only vendor-supported fix. As a short-term measure on a box you cannot update immediately, you can stop the cPanel DAV Daemon (cpdavd) in WHM » Service Configuration » Service Manager, and remove Calendars and Contacts from your feature lists. Treat that as risk reduction, not a fix. cPanel has not said that stopping the service closes the root path, and cpdavd also serves Web Disk (ports 2077/2078) as well as CalDAV/CardDAV (2079/2080), so customers lose both until you re-enable it.

Exploitation status

At disclosure there was no confirmed in-the-wild exploitation, no public proof of concept, and none of the three CVEs was in CISA's Known Exploited Vulnerabilities catalogue. cPanel has not published indicators of compromise. If an unpatched server hosted untrusted accounts, review it the same way as after the September EmailTrack flaw: unexpected root-owned files, new cron entries, and new SSH keys.

An active cPanel license is what lets upcp pull these builds. A lapsed one leaves the server stuck on the vulnerable version.

Next steps

• cPanel TSR-2026-09-29: three WHM vulnerabilities: the next security release, a week later.
• WP Toolkit on cPanel vs Plesk: how the toolkit differs between panels.
• CVE-2026-41940: the cPanel & WHM auth bypass: this year's unauthenticated root bug, for comparison.