privilege-escalation-methodinternet-facing-service-vulnerabilitywidely-deployed-product-advisoryend-of-life-software

Critical cPanel Flaw Lets Hosting Users Escalate to Root Server Control

Attack Tradecraft · 9 sources · Updated 18d ago · First seen Aug 28, 2026

cPanel has patched CVE-2026-65643, a critical flaw in cPanel & WebHost Manager (WHM) domain-parking and addon-domain functionality. A low-privileged authenticated hosting account authorized to add parked or addon domains can create arbitrary files on the underlying server, potentially leading to code execution as root and full control of the host.

The issue affects all supported cPanel & WHM release branches, with fixes issued for 11.110, 11.134, 11.136, and 11.138, including WP Squared. Shared and reseller-hosting operators should apply the relevant patched build immediately; systems on end-of-life branches must be upgraded to a supported release, and unpatched deployments should restrict parked- and addon-domain permissions. cPanel had not disclosed a CVSS score, detection guidance, interim mitigation, or confirmed in-the-wild exploitation.

Who uses this technique?Get the actors, campaigns, and ATT&CK mapping behind it.

Get the tradecraft

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

5 events · Aug 27, 2026 – Sep 1, 2026

Reported Sep 1, 20262mo ago
bjCSIRT issues notice on cPanel & WHM domain-parking vulnerability
Benin’s bjCSIRT published a notice concerning the cPanel & WHM domain-parking functionality vulnerability associated with CVE-2026-65643.
Vulnérabilité dans la fonctionnalité de parking de domaine de cPanel & WHM - bjCSIRT
Sep 1, 20262mo ago
CVE-2026-65643 record received and technical details published
The CVE-2026-65643 record was received by support@hackerone.com. The record characterizes the flaw as CWE-95 eval injection in cPanel 11.138.0.0 and earlier, allowing a low-privileged authenticated remote attacker to execute code as root, with a high-impact CVSS v4 vector.
CVE-2026-65643 - cPanel Eval Injection Remote Code Execution
Aug 28, 20262mo ago
Canadian Centre for Cyber Security issues CVE-2026-65643 advisory
The Canadian Centre for Cyber Security published advisory AV26-861 for CVE-2026-65643, advising cPanel and WHM administrators to review the vendor advisory and apply available updates. The advisory identified affected releases prior to the fixed versions across the 11.110, 11.134, 11.136, 11.138, and WP2 branches.
cPanel security advisory (AV26-861) - Malware News - Malware Analysis, News and Indicators
Aug 28, 20262mo ago
CVE record and exploitation status remain unconfirmed
As of August 28, the CVE Program record store had no published record for CVE-2026-65643, and cPanel had not said whether the flaw was exploited in the wild. The vulnerability was also absent from CISA's Known Exploited Vulnerabilities catalog as of the prior day.
Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Server
Aug 27, 20262mo ago
cPanel discloses and patches CVE-2026-65643
cPanel published a customer advisory for CVE-2026-65643, a critical domain-parking and addon-domain flaw affecting all supported cPanel & WHM versions. An authenticated account permitted to add parked or addon domains could create arbitrary server files and potentially execute code as root; cPanel released fixes for the 11.110, 11.134, 11.136, 11.138, and WP Squared branches.
Critical cPanel Vulnerability Allows Attackers to Take Full Server Control

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Authenticated Root Code Execution in cPanel & WHM Domain Parking (CVE-2026-65643)

Affected products

2 linked

Cpanel & WhmCpanel And Whm

Do you run this?Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.

See Who Uses This Technique

Source coverage

Sources

9 references tracked. Mallory keeps watching after this page renders.

Cvefeed High SeverityAdvisories · Sep 1, 2026

CVE-2026-65643 - cPanel Eval Injection Remote Code ExecutionOpen source ↗

Csirt BjNews · Sep 1, 2026

Vulnérabilité dans la fonctionnalité de parking de domaine de cPanel & WHM - bjCSIRTOpen source ↗

UnclassifiedNews · Aug 29, 2026

Critical cPanel Vulnerability: When a Hosting Account Becomes a Server-Level Threat | by Cyber Chronicle | Aug, 2026 | MeetCyberOpen source ↗

Malware NewsNews · Aug 28, 2026

cPanel security advisory (AV26-861) - Malware News - Malware Analysis, News and IndicatorsOpen source ↗

Ca CcsNews · Aug 28, 2026

cPanel security advisory (AV26-861) - Canadian Centre for Cyber SecurityOpen source ↗

Ca CcsNews · Aug 28, 2026

WebPros security advisory (AV26-861) - Canadian Centre for Cyber SecurityOpen source ↗

Csirt ItaliaNews · Aug 28, 2026

Rilevata vulnerabilità in prodotti cPanel - ACNOpen source ↗

The Hacker NewsNews · Aug 28, 2026

Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole ServerOpen source ↗

Cyber Security NewsNews · Aug 28, 2026

Critical cPanel Vulnerability Allows Attackers to Take Full Server ControlOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Critical cPanel Flaw Lets Hosting Users Escalate to Root Server Control

How this story unfolded

bjCSIRT issues notice on cPanel & WHM domain-parking vulnerability

CVE-2026-65643 record received and technical details published

Canadian Centre for Cyber Security issues CVE-2026-65643 advisory

CVE record and exploitation status remain unconfirmed

cPanel discloses and patches CVE-2026-65643

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

Critical cPanel & WHM Auth Bypass Exploited for Server Takeover

Critical cPanel Flaw Lets Authenticated Users Gain Database Root Privileges

cPanel Authentication Bypass and New RCE Flaws Put Hosting Servers at Risk

Critical cPanel Flaw Lets Hosting Users Escalate to Root Server Control

How this story unfolded

bjCSIRT issues notice on cPanel & WHM domain-parking vulnerability

CVE-2026-65643 record received and technical details published

Canadian Centre for Cyber Security issues CVE-2026-65643 advisory

CVE record and exploitation status remain unconfirmed

cPanel discloses and patches CVE-2026-65643

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

Critical cPanel & WHM Auth Bypass Exploited for Server Takeover

Critical cPanel Flaw Lets Authenticated Users Gain Database Root Privileges

cPanel Authentication Bypass and New RCE Flaws Put Hosting Servers at Risk