A newly disclosed security vulnerability in cPanel and WebHost Manager (WHM), one of the most widely used web hosting management platforms, could allow a low-privilege authenticated user to gain root-level control of an affected server.
Tracked as CVE-2026-65643, the vulnerability resides in cPanel’s domain parking functionality and was publicly detailed in a security advisory published on August 27, 2026.
The flaw is particularly concerning for shared-hosting providers and reseller environments, where multiple independent customers and websites may operate on the same physical or virtual infrastructure.
cPanel CVE-2026-65643 Flaw
According to cPanel, an authenticated account with permission to create parked or addon domains can exploit the vulnerable functionality to create arbitrary files on the underlying server.
Under certain conditions, this capability can be leveraged to achieve code execution with root privileges. The security boundary between an individual hosting account and the underlying operating system is therefore potentially bypassed, transforming what initially appears to be a domain-management issue into a full server compromise.
Domain parking is a common cPanel feature that allows additional domain names to point to an existing website without requiring a completely separate hosting account.
Because parked and addon domains are frequently enabled for ordinary hosting customers, access to the vulnerable functionality may not be limited to highly privileged administrators.
Although exploitation requires authentication, that prerequisite provides limited protection in multi-tenant environments. An attacker could obtain access through a compromised customer account, phishing, password reuse, malware, or by abusing credentials acquired through another intrusion.
Once authenticated, an attacker with the necessary domain-management permissions could trigger the arbitrary file creation vulnerability. Successful exploitation can ultimately provide execution under the root account, giving the threat actor unrestricted control over the affected operating system.
Root access could enable attackers to modify hosted websites, access application databases, read email data, steal configuration files and credentials, deploy persistent web shells, install cryptocurrency miners, disable security controls, or manipulate logging and monitoring mechanisms.
The consequences are significantly broader on shared-hosting servers. A compromised customer account could potentially become the entry point for attacks against other tenants hosted on the same machine.
Depending on the server configuration and available credentials, attackers could access websites belonging to unrelated customers, databases, mailboxes, backup archives, application secrets, and other sensitive resources.
A compromised hosting server could also provide an attacker with a valuable foothold for pivoting into additional systems belonging to the hosting provider or connected infrastructure.
cPanel’s advisory states that supported cPanel and WHM releases are affected and provides patched builds for multiple release branches.
Administrators running versions 11.110.0.141 and later, 11.134.0.53 and later, 11.136.0.37 and later, and 11.138.0.2 and later should ensure their systems have received the applicable security update.
Servers following the WP2 update track require 11.138.1.7 or later. Organizations operating unsupported or end-of-life branches may need to upgrade to a supported release before applying the security fix.
Security teams should treat CVE-2026-65643 as a high-priority patching issue, particularly in shared-hosting and reseller environments.
Administrators should verify that automated updates have successfully installed the patched build rather than assuming updates were applied.
Until remediation is complete, providers can consider temporarily restricting parked-domain and addon-domain permissions for low-trust accounts.
Teams should also investigate unexpected file creation, suspicious scripts, abnormal domain-management activity, new administrative artifacts, and unexplained changes to hosted applications.
Given the combination of authenticated low-privilege access, arbitrary file creation, and potential root-level execution, rapid patching and post-update monitoring are essential to prevent a single compromised hosting account from becoming a gateway to complete server takeover.
No Comment! Be the first one.