CVE-2026-104586 @ morris

"CVE-2026-104586"
"cpanel"
"whm"
"cpanel -V: 110.0 (build 150)"
"Am I vulnerable?"

Status

new

Priority

11.2

Match score

3.1

Risk

RCE Remote priv:user

CVSS

9.8 CRITICAL

Reason

keywords: cpanel, whm; cpanel-build: 110.0.150; risk:rce; remote

Created

2026-10-20T10:16:46Z

Updated

2026-10-20T10:16:46Z

Package interrogation (copy)

Run on the host — click to copy a command. RPM

Package	Commands
cpanel
whm

Inventory lookup

Search package inventory across systems, then return here. Create a ticket on systems the matcher missed.

Suggestions: cpanel · whm

System	Matches	Ticket for CVE-2026-104586
morris	cpanel-monitoring-whm-plugin 1.0.2; cpanel-ng-whm-account-enhancements 110.16.9; cpanel-ng-whm-accounts-manager 110.16.9; cpanel-ng-whm-cloud-cluster 110.16.3; cpanel-ng-whm-connected-applications 110.16.9; cpanel-ng-whm-initial-setup-wizard 110.16.6; cpanel-ng-whm-link-server-nodes 110.16.10; cpanel-ng-whm-multiphp-manager-ng7 110.16.17 (+5 more)	new open
mufasa	cpanel-monitoring-whm-plugin 1.0.2; cpanel-ng-whm-account-enhancements 110.16.9; cpanel-ng-whm-accounts-manager 110.16.9; cpanel-ng-whm-cloud-cluster 110.16.3; cpanel-ng-whm-connected-applications 110.16.9; cpanel-ng-whm-initial-setup-wizard 110.16.6; cpanel-ng-whm-link-server-nodes 110.16.10; cpanel-ng-whm-multiphp-manager-ng7 110.16.17 (+5 more)	new open

Related CVE (same fix)

Point this ticket’s CVE at a higher-priority / same-fix primary so you only triage one.

Host OS / kernel

CloudLinux release 7.9 (Boris Yegorov) (7.9) · cloudlinux

Arch

x86_64

kernel_release

uname -r → 3.10.0-962.3.2.lve1.5.89.el7.x86_64

kernel_version

uname -v → #1 SMP Thu Jul 9 15:55:31 UTC 2026

For Linux kernel CVEs, kernel_version (Debian packaging / build string) often decides fixed vs not; kernel_release is used for upstream NVD range compares.

Same CVE on other hosts

Open the ticket for this CVE on another system.

System	Status	Priority	Updated
mufasa	new	11.2	2026-10-20T10:16:46Z	Open

Description

AUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains an OS Command Injection in borg_restore.cgi.

Update status

Add note only

References

NVD: CVE-2026-104586