SURIQ
cPanel and WHM shipped a security release today, 29 July 2026, fixing three vulnerabilities the vendor collectively rates up to High severity: CVE-2026-58047 in cpsrvd, the daemon that serves the cPanel and WHM web interfaces, CVE-2026-58048 in the panel's database functionality, and GCVE-25-2026-07-45-3 in the bundled Exim mail server. Patched builds exist for every supported branch. Servers that auto-update will pick them up on their own; anything pinned to a fixed version needs a manual push.
If you run a hosting fleet, the short version: two of the three flaws have no public technical details yet, which is normal for cPanel's process and temporary. The clock that matters starts when those details publish, because that is when working exploits tend to follow. The update window is now, while attackers know as little as you do.
Three fixes, two of them still sealed
The release note to customers names the components but not the mechanics. Both CVE records were still marked reserved at the National Vulnerability Database when we checked, and the public changelog entry for the new builds says only "Targeted Security Release".
| Identifier | Component | What is public |
|---|---|---|
| CVE-2026-58047 | cpsrvd, the service behind the cPanel and WHM web interfaces | Details withheld until the disclosure window closes |
| CVE-2026-58048 | Database functionality in the panel | Details withheld until the disclosure window closes |
| GCVE-25-2026-07-45-3 | The Exim mail server that ships with cPanel | Local privilege escalation via .forward file handling; fixed upstream in Exim 4.99.5 |
The patched versions, one per supported branch:
| Branch | Patched version |
|---|---|
| 110 (long-term support) | 11.110.0.137 |
| 126 | 11.126.0.78 |
| 134 | 11.134.0.48 |
| 136 | 11.136.0.32 |
| 138 | 11.138.1.6 |
The release also carries what the vendor describes as additional security hardening for certain supported operating system configurations, with no further specifics.
The Exim flaw is the one with public details
The third item is not a cPanel bug at all. The Exim project fixed GCVE-25-2026-07-45-3 upstream in version 4.99.5, released as a security release under an advisory dated 22 June 2026; today's cPanel update brings that fix to the Exim build the panel ships and manages.
Per the advisory and reporting on the release, exploitation needs a specific configuration: a redirect router that processes user .forward files, combined with a pipe transport using the force_command option, with that pipe running as a privileged user. When all three line up, a local account can get Exim to run commands with elevated privileges. That is not every mail server, but forwarding setups and older mailing-list configurations are where the combination tends to appear. A quick way to see whether your configuration uses the risky option:
grep -n "force_command" /etc/exim.conf exim -bV | head -1
No output from the first command means the force_command precondition is absent from the main config. The second prints the running Exim version. On cPanel servers Exim is installed and updated by the panel, so the panel update is the fix path; separately maintained Exim installs need 4.99.5 or later on their own.
Why cPanel says so little, and what that means for timing
cPanel handles security fixes through what it calls a Targeted Security Release: patched builds ship first, technical details follow later, after the fleet has had time to update. The details being sealed is not a red flag. It is the working assumption behind the process: give defenders a head start measured in days, because once the specifics publish, proof-of-concept code and scanning usually arrive quickly.
Recent history makes the point. cPanel's previous major cpsrvd flaw, the CVE-2026-41940 authentication bypass patched in April, ended up in CISA's known-exploited-vulnerabilities catalog after attackers weaponized it, and this spring's LiteSpeed cPanel plugin escalations showed how quickly panel-layer bugs get picked up once documented. There are no exploitation reports for the three new flaws at the time of writing, and the head start only has value if it is used.
Update the pinned branches first
cPanel installations update themselves nightly by default, so most of the fleet will absorb this release without anyone touching it. The servers that need a human are the ones where updates are pinned to a fixed version or disabled, which in practice means the most change-averse machines: the long-term-support boxes on the 110 branch. Check and update by hand:
cat /usr/local/cpanel/version /usr/local/cpanel/scripts/upcp
Compare the version you see against the table above for your branch. After the update, the quiet second step is verification, the same lesson as patching a gateway and then checking it was not already visited: keep an eye on panel authentication logs and mail logs in the days after the technical details publish. A patched server tells you nothing about what happened before the patch, and with two of the three flaws still sealed, the log review is cheap insurance you can set up today.