"Successful exploitation leads to code execution as the root user, giving an attacker full control of the server," cPanel said in a notification to customers.
CVE-2026-65643: a critical domain-parking and addon-domain flaw
cPanel has released patches for a vulnerability tracked as CVE-2026-65643 that affects domain parking and addon domain functionality in cPanel & WHM. According to the vendor, the flaw allows an authenticated account holder who can add parked or addon domains to create arbitrary files on the server; successful exploitation can result in code execution as the root user. cPanel labelled the issue a critical security vulnerability and said it impacts all supported versions of cPanel & WHM.
Patched builds and deployment options
cPanel published the following patched builds on August 27, 2026:
- 11.110.0.141 or later
- 11.134.0.53 or later
- 11.136.0.37 or later
- 11.138.0.2 or later
- 11.138.1.7 or later (WP Squared)
The notification specifically names WP Squared in the patched list and does not mention DNSOnly. Servers configured for automatic daily updates will receive the patched build automatically. Administrators may also apply the update immediately by logging in as root and running /scripts/upcp --force, or by installing the update from WHM via Home > cPanel > Upgrade to Latest Version. Administrators can verify the installed build under Server Configuration > Update Preferences. Servers running an end-of-life version must first upgrade to a supported branch to receive the fix.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleScope, ambiguities, and related advisories
Several notable ambiguities remain in the public record. The customer notification carries no CVSS score, and The Hacker News confirmed via the CVE Program's record store on August 28, 2026, that no CVE Program record for CVE-2026-65643 had been published at that time. By contrast, records for CVE-2026-58048 and CVE-2026-58047—two cPanel flaws disclosed on July 31—were present in the CVE store during the same check.
cPanel has not said whether CVE-2026-65643 has been exploited in the wild. The issue is not listed in the U.S. Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities (KEV) catalog as of the KEV version released on August 27, 2026. The KEV catalog already contains two cPanel-plugin issues: CVE-2026-48172 (added May 26, 2026), a LiteSpeed cPanel-plugin privilege escalation that CISA noted can be exploited by any cPanel user account to execute arbitrary scripts with root privileges; and CVE-2026-54420 (added June 15, 2026), a symlink-following flaw in the same plugin affecting shared hosting servers running CloudLinux or CageFS where a user has FTP or web shell access. The catalog also lists CVE-2026-41940, an authentication bypass patched in April, with known use in ransomware campaigns.
Other recent advisories remain relevant context: cPanel's July advisory about an Exim flaw said it may allow privilege escalation from Team User sub-accounts; the August 27 notification for CVE-2026-65643 does not specify whether Team User sub-accounts with permission to parked and addon domains are in scope. cPanel's customer notification provides no interim mitigation guidance and no way to verify whether a server has already been compromised.
Connections to Phusion Passenger and Plesk guidance
Earlier in August, cPanel and related vendors addressed issues in Phusion Passenger and in shared hosting environments. In a Phusion Passenger advisory published on August 14, 2026, cPanel carried a command to grep the Apache error log for signs of exploitation; cPanel also said the Passenger issue does not affect default installations and applies only where an affected Passenger package has been installed. Phusion shipped a fix in Passenger 6.2.0 on August 18, 2026, for a Watchdog API flaw that does not have a CVE identifier, and Phusion stated, "We have seen exploitation of this vulnerability in the wild at a shared hosting provider."
Plesk, the product WebPros develops alongside cPanel, updated its advisory for the same Passenger flaw on August 14 with a five-item checklist for spotting prior compromise that begins with unexpected entries in /etc/ld.so.preload. Plesk noted: "Patching closes the vulnerability going forward, but it does not undo anything an attacker may have already done."
What this means for hosting administrators, shared hosting providers, and site owners
- Hosting administrators: Patch immediately if you run a supported cPanel build. Use the automatic daily update pathway or run /scripts/upcp --force as root; verify builds under Server Configuration > Update Preferences. If your server is on an end-of-life branch, plan and execute an upgrade to a supported branch to receive the fix.
- Shared hosting providers: Confirm which account types can add parked and addon domains and review Team User sub-account permissions, since the August notice does not clarify sub-account scope. Review logs where possible for unusual file creation activity and consider vendor checklists (for example, Plesk’s file checks) for signs of prior compromise.
- Site owners and small-site operators on shared platforms: Contact your hosting provider to confirm the patched build has been applied and to ask what, if any, forensic checks the provider will run; the cPanel notification provides no automatic verification for customers.
cPanel's advisory fixes a high-risk pathway by which an authenticated domain-management action could morph into root-level code execution. The company has supplied patched builds and automated-update paths; what remains unanswered in the public notices is whether the flaw is already being exploited, whether particular sub-account models are affected, and which older branches remain supported. Administrators, providers, and customers who rely on cPanel should treat the update as urgent and demand clear confirmation from their vendors and hosts that builds are current and that any necessary post-patch investigations have been completed.
