cPanel has patched a vulnerability that turned one of shared hosting’s most routine features into a route to full server takeover. In an advisory published on August 27, an authenticated cPanel account holder able to add parked or addon domains could create arbitrary files on the server, and “successful exploitation leads to code execution as the root user, giving an attacker full control of the server and every account, website, and database on it.” The flaw, tracked as CVE-2026-65643, affects all supported versions of cPanel and WHM.

Key facts

  • Flaw: CVE-2026-65643, in cPanel’s domain parking functionality; arbitrary file creation leading to root.
  • Who could use it: any authenticated account holder able to add parked or addon domains.
  • Affected: all supported cPanel and WHM versions.
  • Patched builds: 11.110.0.141, 11.134.0.53, 11.136.0.37, 11.138.0.2, and 11.138.1.7 for WP Squared, or later.
  • Status: no CVE record published and no CISA KEV entry as of August 28, by our checks; exploitation status unstated.

From a Customer Account to Every Tenant on the Server

Parked and addon domains are customer-facing cPanel features, though access to them depends on the account’s permissions. That is what makes this flaw’s shape so serious: the advisory requires no WHM administrator account, only an authenticated cPanel account able to add one of those domain types, and the outcome is root, which on a shared server puts every hosted account, site and database in scope.

The fix shipped in five release lines: 11.110.0.141, 11.134.0.53, 11.136.0.37, 11.138.0.2 and, for the WP Squared product, 11.138.1.7. Servers configured for automatic daily updates pick the patch up on their own; administrators who want it immediately can force the update from the command line with /scripts/upcp –force or from WHM, and servers on end-of-life versions have to move to a supported release to get the fix at all, as The Hacker News notes in its write-up.

The Field of cPanel Alternatives Keeps Widening. A Brand-New One Comes From Inside cPanel’s Ecosystem.

What the Advisory Does Not Say

The advisory is four short sections, and the gaps around it are checkable. The identifier is assigned, but no public CVE record for CVE-2026-65643 was available as of August 28: the CVE Program’s record store returns nothing for it, while records for cPanel’s July flaws, CVE-2026-58048 and CVE-2026-58047, are in place. The advisory carries no CVSS score, no workaround for servers that cannot update immediately, and no guidance for checking whether a server has already been hit. cPanel has not said whether the flaw has been exploited.

By our check of CISA’s Known Exploited Vulnerabilities catalog, as updated on August 27, the new flaw is not listed. The catalog does already carry three cPanel-ecosystem entries this year: two flaws in the LiteSpeed cPanel plugin added in May and June, and CVE-2026-41940, the cPanel and WHM authentication bypass patched in April, which CISA flags with known use in ransomware campaigns. The precedent is the reason the exploitation question matters: among those entries sit a plugin flaw CISA describes as exploitable from any cPanel user account to run scripts as root, and an authentication bypass with known ransomware use.

The Hacker News, which reported the patch, raises one further open point: whether Team User sub-accounts with domain permissions are in scope.

What cPanel Hosts Should Do Now

The action list is short. Confirm the server is on a patched build or force the update; check that automatic updates are actually enabled and completing; and treat end-of-life installations as urgent migration cases, because they will not receive this fix. For fleets with customer-facing reseller or team permissions, it is worth reviewing who can add parked and addon domains until the estate is fully patched. Given the advisory offers no compromise-detection guidance, hosts that want assurance will need to rely on their own file-integrity and log monitoring for the affected period.