Full Report
cPanel has released patches for a security flaw affecting domain parking and addon domain functionality in cPanel and WebHost Manager (WHM), which could allow code execution as the root user. The vulnerability, assigned the CVE identifier CVE-2026-65643, impacts all supported versions of cPanel & WHM. cPanel described the issue as a critical security vulnerability and said that an
Analysis Summary
# Vulnerability: Critical Root Code Execution via Domain Parking
## CVE Details
- **CVE ID:** CVE-2026-65643
- **CVSS Score:** N/A (Described as "Critical" by vendor; no official CVSS record published as of August 28, 2026)
- **CWE:** N/A (Likely related to Improper Input Validation or Arbitrary File Write)
## Affected Systems
- **Products:** cPanel & WHM, WP Squared
- **Versions:** All supported versions prior to the patched builds.
- **Configurations:** Systems where authenticated users have permissions to add "Parked" or "Addon" domains.
## Vulnerability Description
The flaw resides in the domain parking and addon domain functionality within cPanel and WHM. An authenticated account holder (typically a shared hosting customer) can exploit this vulnerability to create arbitrary files on the server. Because the underlying processes for these actions often require elevated privileges, the flaw allows for code execution as the **root** user, leading to a complete server compromise.
## Exploitation
- **Status:** Not currently listed in CISA KEV; no public PoC confirmed, but the vendor has released urgent patches.
- **Complexity:** Low (Requires only standard authenticated access to domain management features).
- **Attack Vector:** Network (Authenticated).
## Impact
- **Confidentiality:** Critical (Full access to all data on the server).
- **Integrity:** Critical (Ability to modify any system files or user data).
- **Availability:** Critical (Ability to shut down services or delete data).
## Remediation
### Patches
cPanel has released the following patched versions:
- 11.110.0.141 or later
- 11.134.0.53 or later
- 11.136.0.37 or later
- 11.138.0.2 or later
- 11.138.1.7 or later (WP Squared)
### Workarounds
No specific interim workarounds (such as disabling features) were provided in the advisory. Immediate patching is the recommended course of action.
## Detection
- **Indicators of Compromise:** Administrators should monitor for unexpected entries in `/etc/ld.so.preload` (as noted in related privilege escalation checklists) and unauthorized files created in system directories.
- **Detection methods and tools:**
- Manually trigger an update check: Run `usr/local/cpanel/scripts/upcp --force` as root.
- Verify version: Navigate to **WHM > Server Configuration > Update Preferences**.
- Review audit logs for unusual addon/parked domain activity from non-admin users.
## References
- **cPanel Security Advisory:** hxxps[://]support[.]cpanel[.]net/hc/en-us/articles/42959571221527-Security-CVE-2026-65643-Vulnerability-in-cPanel-s-Domain-Parking-Functionality-August-27-2026
- **The Hacker News Article:** hxxps[://]thehackernews[.]com/2026/08/critical-cpanel-flaw-could-let-one.html