CVE-2026-65643: 
cPanel vulnerability analysis and mitigation

CVE-2026-65643 is an eval injection vulnerability in cPanel's domain parking (Park API) functionality that allows remote authenticated users to execute arbitrary code as root. Disclosed on August 27, 2026, and published to the NVD on September 1, 2026, it affects cPanel versions up to and including 11.138.0.0 across multiple release branches. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, cPanel Advisory).

The vulnerability is classified as CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code — 'Eval Injection'), meaning user-supplied input is passed unsanitized into a dynamic code evaluation call within cPanel's domain parking (Park API) component (GitHub Advisory). An authenticated attacker can craft a malicious request to the Park API endpoint that injects arbitrary code into the evaluated expression, which is then executed with root privileges by the cPanel process. The attack requires only low-level authenticated access (e.g., a standard shared hosting account), no user interaction, and no special configuration — making it straightforward to exploit in typical shared hosting environments (cPanel Advisory).

Successful exploitation grants an attacker full root-level code execution on the affected server, resulting in complete compromise of confidentiality, integrity, and availability. In shared hosting environments — where cPanel is most commonly deployed — a single low-privileged customer account could be used to take over the entire server, exposing all other hosted accounts, their data, credentials, and configurations. This creates significant risk of lateral movement across all co-hosted tenants, data exfiltration, ransomware deployment, or persistent backdoor installation (GitHub Advisory, The Hacker News).

A public scanner/detection script (not a full exploit) was published on GitHub shortly after disclosure, classified as a vulnerability scanner rather than an active exploitation tool (GitHub PoC). A second repository, tc4dy/CVE-2026-65643-PoC-Toolkit, appeared approximately one week later, though its exploitation capability has not been independently confirmed. The EPSS score is approximately 0.904% (58th percentile), indicating a moderate near-term exploitation probability. As of the time of reporting, there is no confirmed in-the-wild exploitation, no CISA KEV catalog listing, and no known threat actor attribution (GitHub Advisory, Feedly).

1. Reconnaissance: Identify internet-facing cPanel instances running vulnerable versions (below 11.110.0.141, 11.112.0.0–11.134.0.53, 11.136.0.0–11.136.0.37, 11.138.0.0–11.138.0.2, or 11.138.1.0–11.138.1.7) using Shodan, Censys, or the public scanner script.
2. Obtain authenticated access: Acquire any valid cPanel user account — this could be a free trial, a low-cost shared hosting account, or compromised credentials. No elevated privileges are required.
3. Target the Park API endpoint: Send a crafted authenticated HTTP request to cPanel's domain parking (Park API) functionality, injecting malicious code into the parameter(s) that are passed to the vulnerable eval() call.
4. Inject eval payload: Embed arbitrary code (e.g., a reverse shell command or system command) within the request parameter. Because the input is not sanitized before being evaluated, the injected code executes in the context of the cPanel process.
5. Achieve root code execution: The injected code runs with root privileges, enabling the attacker to create backdoor accounts, exfiltrate all hosted data, install persistent malware, or pivot to other systems on the network (cPanel Advisory, GitHub Advisory).

• Network: Unusual or unexpected outbound connections from the cPanel/WHM server process to external IPs; authenticated API requests to the Park API endpoint with anomalous or encoded parameter values.
• Logs: cPanel access logs showing authenticated requests to domain parking/Park API endpoints with unexpected or encoded payloads; entries in /usr/local/cpanel/logs/error_log or /usr/local/cpanel/logs/access_log reflecting eval errors or unusual parameter content.
• Process: Unexpected child processes spawned by the cPanel Perl or service process (e.g., /bin/bash, curl, wget, python, nc) with root privileges; new cron jobs or scheduled tasks created under root.
• File System: New or modified files in /root/, /tmp/, or cPanel installation directories; presence of web shells or unauthorized SSH keys in /root/.ssh/authorized_keys; unexpected SUID binaries.
• Authentication: New root-level or privileged system accounts created after the time of suspicious Park API requests (cPanel Advisory).

cPanel (WebPros) has released patched versions addressing this vulnerability. Administrators should upgrade to one of the following fixed releases: 11.110.0.141 or later (for the 11.110 branch), 11.134.0.53 or later (for the 11.112–11.134 branch), 11.136.0.37 or later (for the 11.136 branch), 11.138.0.2 or later (for the 11.138.0 branch), or 11.138.1.7 or later (for the 11.138.1 branch). As interim mitigations, administrators should restrict cPanel user authentication to trusted personnel only, disable domain parking functionality if not required, and monitor system logs for suspicious eval() calls or unexpected process spawning from cPanel processes (cPanel Advisory, GitHub Advisory).

The vulnerability received significant coverage from security media, with The Hacker News describing it as a flaw that could "let one hosting customer take root control of a whole server" — highlighting the severe multi-tenant risk in shared hosting environments (The Hacker News). Community discussion on Reddit's r/cpanel and r/SecOpsDaily reflected concern about the ease of exploitation given that only a standard hosting account is required. The Canadian Centre for Cyber Security (CCCS) issued an advisory (AV26-861) referencing the vulnerability (CCCS Advisory). Security researchers and bloggers noted the particular danger in shared hosting contexts where a single malicious tenant could compromise an entire server and all co-hosted customers (Suriq Blog, Reclaim Hosting).