Full Report
cPanel security advisory (AV26-861)
Analysis Summary
# Vulnerability: Improper Access Control in cPanel Domain Parking Functionality
## CVE Details
- **CVE ID:** CVE-2026-65643
- **CVSS Score:** Not explicitly listed in advisory (Typically High/Critical for this class of vulnerability)
- **CWE:** CWE-284: Improper Access Control (likely, based on "Domain Parking Functionality" context)
## Affected Systems
- **Products:** cPanel & WebHost Manager (WHM)
- **Versions:**
- Versions prior to 11.110.0.141
- Versions prior to 11.134.0.53
- Versions prior to 11.136.0.37
- Versions prior to 11.138.0.2
- Versions prior to WP2: 11.138.1.7
- **Configurations:** Systems utilizing the Domain Parking (Aliases) functionality within the cPanel interface.
## Vulnerability Description
The vulnerability resides within cPanel’s Domain Parking functionality. While the specific technical mechanism (e.g., SSRF, bypass, or symlink attack) is not detailed in the brief advisory, the flaw allows for unauthorized actions or information disclosure related to how domains are parked/aliased on the server. This could potentially allow an attacker to intercept traffic or gain unauthorized access to site configurations.
## Exploitation
- **Status:** Not currently reported as exploited in the wild; no public PoC confirmed.
- **Complexity:** Medium (Requires valid cPanel user access or specific network conditions).
- **Attack Vector:** Network (Authenticated cPanel user).
## Impact
- **Confidentiality:** High (Potential access to other users' domain configurations).
- **Integrity:** High (Potential to redirect or hijack domain traffic).
- **Availability:** Low (Minimal direct impact on service uptime).
## Remediation
### Patches
cPanel has released the following patched versions. Administrators should update to these versions or later:
- **11.110.0.141**
- **11.134.0.53**
- **11.136.0.37**
- **11.138.0.2**
- **11.138.1.7** (WP2)
### Workarounds
No official workarounds have been provided. It is recommended to restrict access to the Domain Parking features for non-trusted users until the patch is applied.
## Detection
- **Indicators of Compromise:** Monitor cPanel access logs for unusual activity involving domain aliasing or parking by users who do not own the primary domain.
- **Detection methods:** Check current software version via WHM or the command line using `/usr/local/cpanel/cpanel -V`.
## References
- **Vendor Advisory:** hxxps[://]support[.]cpanel[.]net/hc/en-us/articles/42959571221527-Security-CVE-2026-65643-Vulnerability-in-cPanel-s-Domain-Parking-Functionality-August-27-2026
- **cPanel Security Portal:** hxxps[://]support[.]cpanel[.]net/hc/en-us/sections/360007088193-Security
- **Cyber Centre Advisory:** AV26-861 (Released 2026-08-28)