CVE-2026-93698

Severity: critical (CVSS 9.9 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-02 · updated 2026-10-02
Weakness: CWE-78

Description

Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.

Affected products

WebPros cPanel: before 11.138.0.11; before 11.136.0.45; before 11.134.0.61; before 11.110.0.148 — fixed in 11.110.0.148, 11.134.0.61, 11.136.0.45, 11.138.0.11
WebPros WP Squared: before 11.138.1.13 — fixed in 11.138.1.13

How to fix

Upgrade to a fixed version: WebPros cPanel 11.110.0.148, 11.134.0.61, 11.136.0.45, 11.138.0.11; WebPros WP Squared 11.138.1.13. Check the vendor advisory for mitigations.

References

https://docs.cpanel.net/changelogs/110-change-log/#1100148
https://docs.cpanel.net/changelogs/134-change-log/#134061
https://docs.cpanel.net/changelogs/136-change-log/#136045
https://docs.cpanel.net/changelogs/138-change-log/#138011
https://docs.wpsquared.com/changelogs/versions/changelog/#138113
https://hackerone.com/reports/4054291
https://support.cpanel.net/hc/en-us/articles/43845931719447-Security-CVE-2026-93698-Vulnerability-in-Multilang-Adminbin-September-29-2026

Get alerted when CVE-2026-93698 or the next vulnerability affects your stack