Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Server
cPanel patched critical flaw CVE-2026-65643 letting authenticated hosting customers with addon or parked domain rights execute code as root and fully compromise servers.
cPanel issued patches on August 27, 2026 for CVE-2026-65643, a flaw in domain parking and addon domain functionality in cPanel & WHM that lets an authenticated account holder create arbitrary files and execute code as root, yielding full server control. Fixed builds cover the 11.110, 11.134, 11.136 and 11.138 branches, including WP Squared 11.138.1.7, and auto-update servers receive the fix automatically. No CVSS score, published CVE record, or evidence of exploitation has appeared, and the flaw is absent from CISA's KEV catalog as of August 27. The article also recaps related 2026 cPanel-ecosystem issues, including KEV-listed LiteSpeed plugin flaws and the in-the-wild-exploited Phusion Passenger problem.
- Authenticated users who can add parked or addon domains can achieve arbitrary file creation and root code execution.
- Patched builds released for branches 110, 134, 136, and 138; auto-update servers receive fixes automatically.
- No CVSS score, CVE record, or KEV entry as of August 28, 2026; exploitation not confirmed.
- Notification provides no interim mitigation or method to verify prior compromise.
- Products
- cPanel & WHM
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-41940 | Missing-Authentication Bypass in WebPros cPanel & WHM (AuthBypass to RCE) | 9.3 | 99% | KEVRansomwarePoC ×9 | KEV |
| CVE-2026-48172 | Privilege Escalation (Possible Root) in LiteSpeed cPanel Plugin | 10.0 | 18% | KEV | KEV |
| CVE-2026-54420 | Symlink-Following Privilege Escalation in LiteSpeed cPanel Plugin Exploited in the Wild | 8.5 | 1% | KEV | KEV |
| CVE-2026-58047 | HTTP Smuggling in cPanel allows potential leak of credentials | 5.6 | <1% | ||
| CVE-2026-58048 | Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context | 9.4 | <1% | ||
| CVE-2026-65643 | Authenticated eval injection in cPanel enables root code execution | 8.7 | <1% |
From the original article
3 min read at thehackernews.com
cPanel has released patches for a security flaw affecting domain parking and addon domain functionality in cPanel and WebHost Manager (WHM), which could allow code execution as the root user. The vulnerability, assigned the CVE identifier CVE-2026-65643 , impacts all supported versions of cPanel & WHM.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.