**cPanel** has released a targeted security update to address a critical flaw, **CVE-2026-58048** (CVSS 4.0 score: 9.4), which could allow an authenticated hosting customer to execute SQL commands in the database's root context. This effectively bypasses privilege boundaries between a **cPanel** account and the server's administrative database identity. ### The Critical SQL Vulnerability The **CVE-2026-58048** vulnerability impacts all supported versions of **cPanel & WHM**, as well as **WP Squared**. Exploitation requires a valid **cPanel** account and access to the MySQL/MariaDB feature. Once exploited, an account holder could execute arbitrary database commands with full administrative privileges. Depending on the operating system and database engine configuration, this could even lead to operating-system-level compromise. **cPanel** has patched **CVE-2026-58048** in the following builds: * 11.110.0.137 * 11.118.0.71 * 11.126.0.78 * 11.134.0.48 * 11.136.0.32 * 138.1.6 for **WP Squared** For servers that cannot update immediately, a temporary workaround involves revoking the MySQL feature from **cPanel** users. This keeps existing databases operational but prevents users from adding or removing databases. Administrators can update via **WHM** or by using the command: `/usr/local/cpanel/scripts/upcp --force`. **CISA's** August 4 enrichment recorded "Exploitation: none" for this flaw, assessing it as non-automatable with a total technical impact. However, this is a snapshot and does not reflect potential developments since. The root cause of this vulnerability lies in **cPanel's** database-renaming process. The **HackerOne CNA** record indicates that SQL mode is not preserved during a database rename, leading to SQL execution in the root context. While the vendor advisory titles it a privilege escalation, the **CNA** classifies it as **CWE-89**, SQL injection, describing the same underlying defect from different perspectives. ### Two More Vulnerabilities Addressed The same security release also addresses two other significant vulnerabilities: #### CVE-2026-58047: HTTP Request Smuggling **CVE-2026-58047** (CVSS 4.0 score: 5.6) is an HTTP request-smuggling issue within `cpsrvd`, the daemon responsible for serving the **cPanel** and **WHM** interfaces. Under specific conditions, an unauthenticated remote attacker could manipulate responses delivered to other users on the same server, potentially leading to credential leakage. **cPanel** credits Vincent55 Yang for reporting both **CVE-2026-58048** and **CVE-2026-58047**. As a temporary workaround, administrators can disable backend connection reuse by setting `cpsrvd_keepalives_disabled=1` in `/var/cpanel/cpanel.config` and restarting `cpsrvd`. **cPanel** notes this workaround will increase latency and CPU usage on busy servers due to forcing new TCP and TLS connections for each request on ports 2083, 2087, and 2096. #### GCVE-25-2026-07-45-3: Exim Forward Privilege Escalation The third advisory covers **GCVE-25-2026-07-45-3** in **Exim**. A local user's `.forward` file can trigger unsafe string expansion in the redirect router under certain pipe-transport configurations. In **cPanel's** default setup, this expansion and execution occur as the **cPanel** user, potentially allowing privilege escalation from **Team User** sub-accounts. **Exim's** advisory states that exploitation requires a redirect router with `.forward` handling, an accessible pipe transport, `force_command` enabled on that transport, and execution as a privileged user. **Exim 4.99.5** resolves this vulnerability. **Exim 4.99.5** also fixes **GCVE-25-2026-07-45-1**, a High-severity local directory traversal flaw through queue-name command-line arguments. This vulnerability could allow access to files outside the spool area and be used for privilege escalation. ### Update Discrepancies and Recommendations Administrators should be aware of a discrepancy in **cPanel's** advisories regarding patched builds. The database advisory lists build `11.118.0.71` among the fixed releases, while the request-smuggling and **Exim** advisories omit the 11.118 branch. Users on the 11.118 branch should verify their installed point release against the database advisory to ensure they have the necessary patches. Neither **Exim** advisory names a specific researcher, instead crediting "the unnamed and uncredited authors whose works were ingested as the training corpus." Given the critical nature of these vulnerabilities, particularly **CVE-2026-58048**, immediate patching is strongly recommended for all **cPanel & WHM** and **WP Squared** installations.