Skip to content

cPanel/WHM CVE-2026-65643: parked/addon-domain file write yields root code execution on shared hosting

Summary

On August 27, 2026, cPanel released a patch for CVE-2026-65643, a critical flaw in domain parking and addon-domain functionality in cPanel and WebHost Manager (WHM) affecting all supported versions: an authenticated account holder who can add parked or addon domains can create arbitrary files on the server, and "successful exploitation leads to code execution as the root user, giving an attacker full control of the server" (cPanel). Fixed in build 11.138.1.7 or later (WP Squared).

No CVSS score is published; cPanel provides no interim mitigation and no way to verify prior compromise; the notification names exploitation as unknown and the CVE is absent from CISA KEV as of the August 27, 2026 catalog version. As of August 28, 2026, no CVE Program record had been published for CVE-2026-65643 (THN confirmation via the CVE Program record store), while records for the July 31, 2026 cPanel flaws CVE-2026-58048 / CVE-2026-58047 were present.

Tags

Why this matters

  • On shared hosting, one customer account with permission to add parked or addon domains can take root on the whole server — a single tenant's compromise becomes a full-host takeover affecting every co-tenant. This is the classic shared-hosting blast-radius primitive.
  • cPanel runs on a very large internet-facing install base; even without confirmed exploitation, an unpatched shared-hosting server is now a patch-now target, and hosting providers are the right responders.
  • The CVE program record gap plus no CVSS and no KEV entry mean defenders cannot rely on catalog tooling — the vendor notification is the source of truth.

Affected and fixed

  • Affected: all supported versions of cPanel & WHM; the August 27, 2026 notification covers the 110, 134, 136, and 138 branches.
  • Fixed: cPanel build 11.138.1.7 or later (WP Squared). The notification names WP Squared in the patched list and does not mention DNSOnly.
  • cPanel patched three separate flaws in July 2026 on the 11.118 and 11.126 branches; the company has not said whether those branches remain supported.
  • End-of-life versions must be upgraded to a supported version to receive the fix.
  • Servers on automatic daily updates receive the patched build automatically; administrators can force it with /scripts/upcp --force (as root) or via WHM → Home → cPanel → Upgrade to Latest Version, and verify under Server Configuration → Update Preferences.

Unknowns to watch

  • Whether a Team User sub-account with parked/addon-domain permission is in scope (the July 2026 Exim advisory explicitly allowed privilege escalation from Team User sub-accounts; this notification is silent).
  • No public exploitation reports, no CVSS, no KEV listing, and no CVE Program record as of August 28, 2026.
  • No vendor-published IOCs or compromise-verification procedure.
  • CISA KEV already carries two LiteSpeed cPanel plugin flaws: CVE-2026-48172 (May 26, 2026; any cPanel user account → arbitrary script execution with root privileges) and CVE-2026-54420 (June 15, 2026; symlink-following flaw on CloudLinux/CageFS shared hosting with FTP or web-shell access), plus CVE-2026-41940 (April 2026 authentication bypass with known ransomware use — see the Mr_Rot13 cPanel campaign).
  • Plesk (WebPros' sibling product) updated its advisory for a related Phusion Passenger flaw on August 14, 2026 with a five-item prior-compromise checklist beginning with unexpected entries in /etc/ld.so.preload. Phusion shipped a Passenger 6.2.0 fix (August 18, 2026) for a Watchdog API flaw and reported in-the-wild exploitation at a shared hosting provider.

Detection and response

  1. Upgrade shared-hosting servers now (/scripts/upcp --force to build ≥ 11.138.1.7 / WP Squared; verify the installed build under WHM → Server Configuration → Update Preferences).
  2. Inventory accounts with parked/addon-domain permissions on shared hosts; treat any anomalous file creation or root-level execution from such accounts as a high-priority incident.
  3. Hosting providers: assume tenant-level compromise can mean full-host compromise; scope lateral movement from each tenant's file-write surface, review root cron, /etc/ld.so.preload, new service accounts, and unexpected outbound connections.
  4. Preserve evidence before cleanup; cPanel's notification provides no compromise-verification tooling, so apply general web-root and host compromise triage.
  5. Watch for a CVE Program record and KEV listing — both are expected to follow if exploitation is confirmed; re-check both catalogs.

Assessment limits

  • No CVSS score, no CVE Program record, no KEV entry, and no public exploitation as of August 28, 2026.
  • Team User sub-account scope is unconfirmed.
  • This page is based on cPanel's customer notification as reported by The Hacker News (August 28, 2026).

Sources