CVE-2026-104586

CVSS 9.8 (critical) · published 2026-10-15

AUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains an OS Command Injection in borg_restore.cgi.

Weakness: CWE-94

Source: NVD CVE-2026-104586

References

• https://github.com/AmalJafarzade/CVE-2026-104586
• https://github.com/AnoopAlias/AUTOM8N
• https://github.com/AmalJafarzade/CVE-2026-104586

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.