Quick Takeaways
- The CVE-2026-65643 vulnerability allows authenticated users to execute arbitrary code as the root user via domain parking and addon domain features in cPanel/WHM, leading to complete server compromise.
- Exploitation of this flaw can result in remote code execution with root privileges, potentially enabling full control over affected servers.
- The vulnerability remains unexploited in the wild but poses a high risk; immediate patching and monitoring are essential to prevent malicious activities.
Threat Overview, Attack Techniques, and Targets
The security flaw in cPanel affects all supported versions of cPanel and WebHost Manager (WHM). The vulnerability is identified as CVE-2026-65643. It is described as a critical security issue. An authenticated user with permission to add parked or addon domains can exploit this flaw. The attack allows the creation of arbitrary files on the server. If successful, the attacker can execute malicious code as the root user. This gives them full control over the server.
The attacker targets servers hosting multiple websites or client accounts. They may also target hosting providers using cPanel. In addition, the flaw impacts the functionality related to domain parking and addon domains. Exploiting this flaw may involve tricking the system into running malicious scripts or files.
Impact, Security Implications, and Remediation Guidance
The main impact is that an attacker can gain complete control of the server. This includes running malicious code with root privileges. Such control can lead to data theft, server disruption, or further attacks. The vulnerability poses a serious risk for hosting providers and their clients.
cPanel has released patches for this flaw in several supported versions. Administrators should update to version 11.110.0.141 or later, 11.134.0.53 or later, 11.136.0.37 or later, 11.138.0.2 or later, or 11.138.1.7 or later (WP Squared). Servers with automatic updates will receive the patch automatically. Manual updating can be done by running specific commands or through the WHM interface.
Because the CVE has not been assigned a CVSS score or publicly exploited reports, organizations should seek further information from the vendor or relevant security authority. Proper patching and monitoring are essential to prevent exploitation. Vulnerable servers that are end-of-life require upgrading to supported versions.
Expand Your Tech Knowledge
Dive deeper into the world of Cryptocurrency and its impact on global finance.
Explore past and present digital transformations on the Internet Archive.
ThreatIntel-V1
