{"id":"CVE-2026-93698","published":"2026-10-02T07:16:39Z","modified":"2026-10-02T19:16:42Z","title":"Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin","vendor":"Webpros","product":"cPanel","tier":"core","eol":null,"description":{"text":"Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an insufficient input validation issue in the Multilang adminbin component of Webpros cPanel, which allows arbitrary operating system commands to be executed. An attacker with network access and low-privilege authenticated credentials, requiring no user interaction, can exploit it to run commands with a scope change that affects confidentiality, integrity, and availability.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:17:43Z"},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.00633,"percentile":0.50308,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":5,"pulses":[{"name":"Known_Cve | Oct 11, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6aca554665c47eb24716f8f2","created":"2026-10-10"},{"name":"Known_Cve | Oct 10, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6ac903591ff588ac9423f235","created":"2026-10-09"},{"name":"Known_Cve | Oct 9, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6ac7b19da11e545ded10ae9b","created":"2026-10-08"},{"name":"Known_Cve | Oct 8, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6ac65e541c36819c31053833","created":"2026-10-07"},{"name":"Known_Cve | Oct 7, 2026 | Part 2/2","url":"https://otx.alienvault.com/pulse/6ac50f851d74c73e484f44c6","created":"2026-10-06"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://docs.cpanel.net/changelogs/110-change-log/#1100148","tags":[]},{"url":"https://docs.cpanel.net/changelogs/134-change-log/#134061","tags":[]},{"url":"https://docs.cpanel.net/changelogs/136-change-log/#136045","tags":[]},{"url":"https://docs.cpanel.net/changelogs/138-change-log/#138011","tags":[]},{"url":"https://docs.wpsquared.com/changelogs/versions/changelog/#138113","tags":[]},{"url":"https://hackerone.com/reports/4054291","tags":[]},{"url":"https://support.cpanel.net/hc/en-us/articles/43845931719447-Security-CVE-2026-93698-Vulnerability-in-Multilang-Adminbin-September-29-2026","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-91198","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-91198","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-02","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93698","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":18.8,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":10.06,"detail":"percentile 0.5031"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":1.77,"detail":"5 pulses"},{"name":"CVSS severity","points":6.93,"detail":"base score 9.9"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}