CVE-2026-93698
Received Received - Intake

Arbitrary Command Execution in Multilang via Adminbin

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: HackerOne

Description
Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-02
AI Q&A
2026-10-02
EPSS Evaluated
N/A
NVD
CVE-2026-93698
EUVD
EUVD-2026-91198

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
cpanel whm 11.110.0.148
cpanel whm 11.134.0.61
cpanel whm 11.136.0.45
cpanel whm 11.138.0.11
wp_squared wp_squared to 136.1.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-93698 is a vulnerability in the Multilang Adminbin component of cPanel/WHM. It involves insufficient validation that allows arbitrary commands to be executed. Successful exploitation can lead to code execution with root privileges.

Detection Guidance

Check if your cPanel/WHM version is outdated by running 'cat /usr/local/cpanel/version' in the terminal. Compare the output against the patched versions listed in the advisory (11.110.0.148+, 11.134.0.61+, etc.). Look for suspicious command execution attempts in logs like /var/log/cpanel/access_log or /var/log/messages.

Impact Analysis

An attacker exploiting this flaw could gain full control over the server, including all accounts, websites, and databases. This could lead to data theft, unauthorized modifications, or complete system compromise.

Compliance Impact

This vulnerability allows arbitrary command execution with root privileges, which could lead to unauthorized access to sensitive data. This would likely violate GDPR's data protection requirements and HIPAA's security rules for protected health information.

Mitigation Strategies

Update cPanel/WHM to the latest patched versions immediately: 11.110.0.148 or later, 11.134.0.61 or later, 11.136.0.45 or later, 11.138.0.11 or later, or WP2: 11.138.1.13 or later. Disable unnecessary services and restrict root access until updates are applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93698. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart