cPanel has released a critical security patch addressing CVE-2026-58048, a vulnerability that allowed authenticated hosting customers to execute SQL commands with database root privileges, effectively bypassing account-level security boundaries. The targeted security release also fixes two additional vulnerabilities that could enable privilege escalation beyond account boundaries.
cPanel has patched a flaw that let an authenticated hosting customer execute SQL in the database's root context, crossing the privilege boundary between a cPanel account and the server's administrative database identity. It shipped in a targeted security release that closes two other routes past account boundaries. The database bug is tracked as CVE-2026-58048 (CVSS 4.0 score: 9.4) and affects
Originally published at thehackernews.com
60-minute technical evaluation, no obligation. We'll map the ideas in this article to your environment.
