Published on 7 August 2026
Imagine your website runs – as is the case for millions of small businesses – on a shared server at a web host. That server holds not just your data, but also that of dozens of other customers. And now, all it takes is a single one of those customers with malicious intent to exploit a freshly discovered vulnerability and gain access to all the databases on the entire server – including your customer data, orders and contact form entries. That is exactly what the critical vulnerability CVE-2026-58048 in cPanel & WHM makes possible.
The good news first: a patch already exists. The urgent news: there is publicly available attack code (proof of concept), and cPanel is in use across a large part of the German hosting infrastructure. Act now.
On 31 July 2026, the vulnerability CVE-2026-58048 was officially published in the US National Vulnerability Database (NVD). It affects cPanel & WHM – the world's most widely used management interface for web hosting – as well as the WP Squared product. The vulnerability reaches a CVSS score of 9.4 out of 10 and is therefore rated critical.
The core of the problem: an authenticated cPanel user (i.e. someone with valid access to a hosting account on the server) can, via a flaw in the database renaming process, execute their own SQL commands in what is known as the database's root context – that is, with full administrator privileges instead of within the heavily restricted area of their own account. SQL is the query language used to control databases.
The official cPanel security advisory describes the impact unambiguously:
"An authenticated cPanel account holder with access to the MySQL/MariaDB database feature could potentially execute arbitrary database commands with full administrative privileges. Depending on the operating system and database configuration, this could escalate to compromise of the operating system." – cPanel / WebPros
In parallel, a second flaw was closed: CVE-2026-58047 (CVSS 5.6) enables what is known as HTTP request smuggling – under certain circumstances an attacker can manipulate server responses so that other users' credentials are intercepted. An Exim vulnerability (the mail server) was also fixed in the same release.
Why can an ordinary user suddenly act as an administrator? Security expert Pierluigi Paganini of Security Affairs gets to the point:
"The cause lies in something almost mundane: renaming a database. When cPanel renames a database, it creates a replacement database, moves the data, recreates the permissions and stored procedures, and then deletes the original along with its rights. Somewhere in this process the SQL mode is not correctly preserved – and that is exactly the crack through which commands are executed with root authority instead of the account's normal restricted privileges."
The publicly available proof of concept – i.e. the example code that demonstrates the attack – uses cPanel's UAPI interface and runs in just a few steps: log in to the cPanel interface, set the SQL mode to "ANSI_QUOTES", pass a crafted database name containing special SQL characters to the rename function – and the injected commands are executed with administrator privileges. Technically, this is a SQL injection (CWE-89), i.e. the injection of database commands via an input field that should really only expect harmless data.
The CVSS vector makes the danger clear: attack possible over the network, low attack complexity, no user interaction required, and full impact on confidentiality, integrity and availability. The only hurdle: the attacker needs a valid cPanel account with the database feature enabled.
Affected are all supported cPanel & WHM versions prior to the patch, as well as WP Squared. The flaw is particularly relevant for shared hosting environments – i.e. the typical low-cost hosting packages where many customers share a single server. And that is precisely where most small and medium-sized enterprises run their websites.
SecPod analyst Meghana Raatni puts it into context:
"The vulnerability is remotely exploitable by any authenticated cPanel user with access to the MySQL/MariaDB feature and requires no user interaction. This makes it especially potent in shared hosting environments where multiple customers operate on the same server infrastructure."
To give a sense of scale: according to watchTowr, cPanel manages more than 70 million domains worldwide and, according to Datanyze, holds a market share of around 22–23% among the tracked hosting panels. Particularly at risk are WordPress installations, WooCommerce shops, CRM systems and all applications that store data in a database.
The Hacker News offers an important caveat: a critical rating says nothing about how many servers are actually vulnerable – what matters is who holds accounts on the server. A server whose accounts all belong to the same company presents a different risk than one that sells accounts to third-party customers.
:2083 or /cpanel, the cPanel logo is visible in the login area, or your provider advertises "cPanel Hosting"./usr/local/cpanel/cpanel -V/usr/local/cpanel/scripts/upcp --force. Alternatively, in the WHM interface under "Upgrade to Latest Version". cPanel released the patches on 29/30 July 2026 in a targeted security release.echo 'cpsrvd_keepalives_disabled=1' >> /var/cpanel/cpanel.config && pkill -9 cpsrvd && /usr/local/cpanel/scripts/restartsrv_cpsrvd. Reverse it after the update (set the value to 0, restart cpsrvd). Note: this workaround increases latency and CPU load.At the time of writing there are no reports of active exploitation. On 31 July 2026 CISA assessed: "Exploitation: none; Automatable: no; Technical Impact: total." That means: no known mass attack, but full compromise possible if successful. The California Cybersecurity Integration Center (CAL-CSIC) also notes in its advisory of 3 August 2026 that successful exploitation would allow an attacker to "access, modify, exfiltrate and delete all databases on the affected host" – but that no exploitation in the wild is currently known.
The EPSS score (likelihood of exploitation) stood at a low 0.50% as of 5 August 2026. But beware: a public PoC already exists – experience shows that the number of attack attempts rises quickly afterwards. The preceding vulnerability CVE-2026-41940 (an authentication bypass from April 2026) illustrates this vividly: within a few days of becoming known, over 44,000 IPs were compromised and more than 572,000 exposed cPanel instances were identified worldwide, according to the Shadowserver Foundation.
If an attacker gains access to databases containing personal data via CVE-2026-58048 – such as customer data, order data, contact form entries or WordPress user data – this constitutes a personal data breach under Art. 4 No. 12 GDPR.
In that case the reporting obligation under Art. 33 GDPR applies: the competent data protection supervisory authority must be informed within 72 hours of becoming aware. Importantly, this obligation already applies where a data leak has not yet been conclusively established but also cannot be ruled out – as interpreted by the Bavarian State Office for Data Protection Supervision (BayLDA) in comparable cases such as Log4Shell or the Microsoft Exchange vulnerabilities.
If there is a high risk to the affected individuals, they must additionally be notified under Art. 34 GDPR. Breaches of the reporting obligation can result in substantial fines under Art. 83 GDPR – up to €10 million or 2% of global annual turnover, and in more serious cases up to €20 million or 4%. On top of this come potential claims for damages by affected individuals under Art. 82 GDPR.
If your hosting provider operates cPanel as a data processor, they must inform you as the controller of a data breach without undue delay under Art. 28 (3) (f) GDPR. For SMEs without their own data protection officer, immediate consultation with a data protection expert is advisable if a breach is suspected. And for reassurance: it is not the mere existence of the vulnerability that triggers the reporting obligation – only actual or likely exploitation with access to personal data.
NeuraCyb Intelligence sums up the true heart of the danger:
"The critical issue is not simply that cPanel contained a SQL injection flaw. It is the question of where the injected SQL ran. By executing database operations in an administrative context, CVE-2026-58048 turned a permitted customer function into a potential path to cross-tenant compromise. For shared hosting providers, this makes patching a damage-limitation priority – not a routine task."
For SMEs in Germany, we rate the risk as HIGH. The attack surface is indeed limited by the authentication requirement – but hosting credentials can be obtained through phishing, credential stuffing or compromised devices. On the economic context: according to the IBM Cost of a Data Breach Report 2026, the average cost of a data breach is US$4.99 million – a record high. And 46% of small businesses experienced a cyberattack in 2025.
CVE-2026-58048 is one of the more dangerous cPanel vulnerabilities of recent times – not because of technical sophistication, but because in shared hosting environments it dissolves the boundary between customers. A harmless "rename a database" potentially becomes full access to all the databases on the server.
The key message: a patch already exists, and public attack code already exists. Don't wait until the theoretical threat becomes a real incident. Check your cPanel version today, trigger the update, or contact your hosting provider with the clear question: "Is my server already running a patched version?" Get the answer in writing. The preceding case, CVE-2026-41940, with over 44,000 compromised IPs within days, shows just how little time there is when it comes to cPanel vulnerabilities.