High severity · published Sep 1, 2026
CVE-2026-65643
Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root
8.8
CVSS
0.9%
EPSS
No
On KEV
Description
Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CP
cPanel · WebPros
before 11.110.0.141; 11.112.0.0 before 11.134.0.53; 11.136.0.0 before 11.136.0.37; 11.138.0.0 before 11.138.0.2; 11.138.1.0 before 11.138.1.7 · source: vendor, NVD
In the news
VulnerabilityCritical
Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Server
cPanel has released patches for a security flaw affecting domain parking and addon domain functionality in cPanel and WebHost Manager (WHM), which could allow code execution as the root user.
The vulnerability, assigned the CVE identifier CVE-2026-65643, impacts all supported versions of cPanel & WHM.
cPanel described the issue as a critical security vulnerability and said that an
Aug 28, 2026·The Hacker News
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-65643
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-65643
support.cpanel.net
https://support.cpanel.net/hc/en-us/articles/42959571221527-Security-CVE-2026-65643-Park-API-Vulnerability-August-27-2026
More from cPanel
9.8
CVE-2026-41940
WebPros cPanel and WHM Authentication Bypass via Login Flow
9.9
CVE-2026-93698
Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin
9.9
CVE-2026-67401
A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component
9.4
CVE-2026-87899
Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges
9.4
CVE-2026-58048
Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context