External risk intelligence

AUTOM8N cPanel Plugin OS Command Injection

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-104586

The vulnerability exists in a WHM/cPanel plugin (AUTOM8N). As cPanel and its associated plugins are commonly deployed on internet-facing web servers to manage web hosting environments, the plugin's functionality is frequently reachable via the public internet as part of the management interface for web services.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical security vulnerability in the AUTOM8N plugin for WHM/cPanel, specifically within the `borg_restore.cgi` component. The flaw allows for the injection of operating system commands, which could potentially be exploited remotely without authentication. The primary concern is to confirm if this specific plugin is in use and, if so, to understand the scope of its deployment and exposure.

It’s a command injection flaw.
Affects a web hosting management tool.
Confirm if AUTOM8N plugin is in use.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request to the affected system. The vulnerability lies within the `borg_restore.cgi` script, which is part of the AUTOM8N plugin for WHM/cPanel. If an attacker can reach this script, they might be able to inject operating system commands, potentially leading to significant compromise of the server.

No authentication or user interaction needed.
Targeted script reachable over the network.
Complete system compromise possible.

Live Threat

Current exploitation, exposure, and threat context

A critical vulnerability in the AUTOM8N WHM/cPanel plugin could allow an unauthenticated attacker to execute arbitrary operating system commands remotely when the plugin is supported by the advisory. This could affect the integrity and availability of the underlying server.

Server commands execution.
Via network request to the plugin.
Potential server compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This OS Command Injection vulnerability in the AUTOM8N WHM/cPanel plugin impacts systems running the affected component. Infrastructure or platform teams managing WHM/cPanel environments are likely responsible for addressing this. The immediate first step is to identify all instances of the AUTOM8N plugin, confirm its reachability and business criticality, and then proceed with remediation planning based on the assessed risk.

Infrastructure and platform teams should own this.
Verify AUTOM8N plugin presence and reachability.
Plan remediation based on business criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the AUTOM8N plugin for WHM/cPanel?

AUTOM8N is an add-on software component designed for WHM/cPanel, a popular web hosting control panel. It is typically used to automate specific server management or backup tasks. This vulnerability specifically impacts the borg_restore.cgi script, a utility within the plugin intended to help administrators restore data.

What does OS Command Injection mean for CVE-2026-104586?

This vulnerability is classified as CWE-94, which refers to improper control of generation of code. In simple terms, it means the software fails to properly filter the input it receives. Because of this, an attacker can insert their own operating system commands into the plugin's processes, effectively tricking the server into running unauthorized instructions.

How does an attacker trigger this vulnerability?

The issue is triggered when an attacker sends a specially crafted network request directly to the vulnerable borg_restore.cgi script. Notably, the vulnerability does not require the attacker to have an account, log in, or interact with a user; the plugin itself performs the commands automatically upon receiving the malicious request.

Is my server at risk if I run this plugin?

According to Halo Surface Signal, because AUTOM8N is a WHM/cPanel plugin, it is often deployed on internet-facing web servers where management interfaces are reachable. If your specific instance of this plugin is accessible via the public internet, it faces a higher likelihood of being targeted compared to plugins restricted to internal, private networks.

What should I do if I have AUTOM8N installed?

Your first step is to confirm whether the AUTOM8N plugin is installed on your WHM/cPanel environment. Once identified, evaluate whether the plugin is essential for your current operations. If it is, restrict network access to the affected script immediately while you coordinate with your infrastructure team to plan for updates or removal.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.