A newly disclosed critical vulnerability in **cPanel** and **WebHost Manager (WHM)** could allow authenticated account holders to gain full root access to affected servers. The flaw, identified as **CVE-2026-65643**, impacts all supported versions of **cPanel & WHM** and stems from improper handling of domain parking and addon domain features. ### Vulnerability Details **cPanel** describes **CVE-2026-65643** as a critical security issue where an authenticated user with permissions to add parked or addon domains can create arbitrary files on the server. Successful exploitation ultimately leads to code execution as the root user, giving an attacker complete control over the compromised system. ### Patch Availability and Remediation **cPanel** has issued patches for the following versions: * 11.110.0.141 or later * 11.134.0.53 or later * 11.136.0.37 or later * 11.138.0.2 or later * 11.138.1.7 or later (**WP Squared**) Servers configured for automatic daily updates should receive the patched build automatically. Administrators can also force the update immediately by logging in as root and running `/scripts/upcp --force`, or by navigating to Home > cPanel > Upgrade to Latest Version within **WHM**. Users running end-of-life **cPanel** versions must upgrade to a supported release to apply the fix.  ### Broader Context: Recent cPanel Vulnerabilities This latest patch follows a series of security advisories from **cPanel**. In July, the company addressed three separate flaws, with fixed builds for the 11.118 and 11.126 branches. The current advisory does not clarify the support status of these older branches. Notably, **cPanel**'s July advisory for an **Exim** flaw mentioned potential privilege escalation from Team User sub-accounts. The current notification for **CVE-2026-65643** does not specify whether Team User sub-accounts with domain parking permissions are in scope for this vulnerability. ### Exploitation Status and CISA KEV Catalog As of August 27, 2026, **cPanel** has not confirmed whether **CVE-2026-65643** has been actively exploited in the wild. The vulnerability is also not yet listed in the U.S. **Cybersecurity and Infrastructure Security Agency (CISA)**'s **Known Exploited Vulnerabilities (KEV)** catalog. The **CISA KEV** catalog does, however, include several other **cPanel**-related vulnerabilities: * **CVE-2026-48172**: A privilege escalation issue in the **LiteSpeed cPanel** plugin, added May 26, 2026, allowing any **cPanel** user to execute arbitrary scripts with root privileges. * **CVE-2026-54420**: A symlink-following flaw in the same **LiteSpeed** plugin, added June 15, 2026, affecting shared hosting servers running **CloudLinux** or **CageFS** where users have FTP or web shell access. * **CVE-2026-41940**: An authentication bypass patched in April, known to be exploited in ransomware campaigns. ### No Interim Mitigations or Compromise Detection **cPanel**'s customer notification for **CVE-2026-65643** does not provide interim mitigation strategies or methods to verify if a server has already been compromised by this specific flaw. This contrasts with a prior advisory for a **Phusion Passenger** vulnerability (**Watchdog API** flaw, without a **CVE**), where **cPanel** provided a command to `grep` Apache error logs for signs of exploitation. **Plesk**, which shares development with **cPanel** under **WebPros**, updated its advisory for the same **Phusion Passenger** flaw on August 14, 2026, offering a five-item checklist for spotting prior compromise, starting with unexpected entries in `/etc/ld.so.preload`. **Phusion** itself shipped a fix for the **Passenger Watchdog API** flaw in **Passenger 6.2.0** on August 18, 2026, noting observed exploitation in the wild at a shared hosting provider. For **CVE-2026-65643**, the primary recommendation is immediate patching.