AUTOM8N WHM/cPanel plugin: OS command injection in borg_restore.cgi

Summary

The AUTOM8N plugin for WHM/cPanel through commit 82821f7 contains an OS command injection in the borg_restore.cgi script. According to the public proof of concept, an authenticated WHM user can append shell metacharacters to form parameters, and the injected commands run as root on the hosting server. A public proof of concept exists, and CISA SSVC rates exploitation as poc and automatable as yes.

Affected

• AUTOM8N WHM/cPanel plugin through commit 82821f7
• Vendor and version details: Unknown.

Fixed in

Unknown. No fixed version or patched commit has been confirmed.

Workaround

• No vendor-confirmed workaround.
• Remove or disable the AUTOM8N plugin if it is not required.
• Restrict WHM access to trusted administrators and review reseller and user accounts.

Exploitation

• Public proof of concept: yes (GitHub repository by Amal Jafarzade, Sploitus).
• Known exploitation in the wild: no evidence found.
• CISA KEV: not listed.
• EPSS: 0.01526 (Vulners).

Our recommendation

• Check whether the AUTOM8N plugin is installed on any WHM server.
• If installed and not needed, remove it immediately.
• If required, restrict WHM access to trusted administrators, monitor for unexpected processes and file changes, and check the upstream repository for a fixed commit after 82821f7.
• Treat any server where exploitation is suspected as fully compromised.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  AmalJafarzade/CVE-2026-104586

Research sources

• CVE-2026-104586 GitHub proof of concept repository github.com
• AUTOM8N upstream repository github.com
• OpenCVE CVE-2026-104586 app.opencve.io
• PSIRT CVE-2026-104586 psirt.com
• Vulners NVD CVE-2026-104586 vulners.com
• VulDB 420674 vuldb.com
• Sploitus exploit entry sploitus.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:47.