How severe is CVE-2026-87899?

CVE-2026-87899 has a CVSS 4.0 base score of 9.4, rated critical severity.

Is CVE-2026-87899 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (46th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-87899?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2026-87899 published?

CVE-2026-87899 was published on 2026-09-23 and last updated on 2026-09-24.

CVE-2026-87899

CVE-2026-87899 is a critical-severity vulnerability with a CVSS 4.0 base score of 9.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-250.

Key facts

Severity: Critical (CVSS 4.0 base score 9.4)
EPSS exploit prediction: 1% (46th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-250
Published: 2026-09-23
Last modified: 2026-09-24

Description

Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges.

Frequently asked questions

What is CVE-2026-87899?: Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges.
How severe is CVE-2026-87899?: CVE-2026-87899 has a CVSS 4.0 base score of 9.4, rated critical severity.
Is CVE-2026-87899 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (46th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-87899?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2026-87899 published?: CVE-2026-87899 was published on 2026-09-23 and last updated on 2026-09-24.

References

https://support.cpanel.net/hc/en-us/articles/43591715125271

Other CWE-250 vulnerabilities

CVE-2026-4606 — Critical (CVSS 10.0): GV Edge Recording Manager (ERM) v2.3.1 improperly runs application components with SYSTEM-level privileges, allowing…
CVE-2022-2634 — Critical (CVSS 10.0): An attacker may be able to execute malicious actions due to the lack of device access protections and device…
CVE-2026-70496 — Critical (CVSS 9.9): A flaw was found in search-v2-operator. The operator's ClusterRole has permissions equivalent to a cluster…
CVE-2026-72508 — Critical (CVSS 9.9): A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM).…
CVE-2026-48584 — Critical (CVSS 9.9): Execution with unnecessary privileges in Azure Synapse allows an authorized attacker to elevate privileges over a…
CVE-2026-50566 — Critical (CVSS 9.9): Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and…

Browse all CWE-250 vulnerabilities →