A privilege‑escalation flaw exists in cPanel that allows a remote authenticated user to execute arbitrary code with root privileges. The vulnerability is categorized as CWE‑250, representing an improper elevation of privilege. An attacker who can log into a cPanel instance with a user account can leverage this flaw to gain unrestricted control over the underlying operating system, potentially compromising all services and data on the server.

The affected product is cPanel, a web hosting control panel widely used across shared and dedicated hosting environments. No specific version information is available from the CVE data, so the issue may affect any unpatched cPanel deployment.

The CVSS score of 9.4 classifies the bug as critical, indicating a high likelihood of severe impact if exploited. The EPSS score is not available, but the lack of a KEV listing does not diminish the urgency of patching. Although the description does not detail a specific attack vector, the likely path involves an authenticated user accessing cPanel’s administrative functions and executing commands with administrative rights. Because the flaw permits root-level execution, the security risk is both immediate and total for affected servers.