o 11.110.0.141<\/p>\n\n
o 11.134.0.53<\/p>\n\n
o 11.136.0.37<\/p>\n\n
o 11.138.0.2<\/p>\n\n
o versions prior to 11.138.1.7<\/p>\n\n
On August 27, 2026, cPanel published a security advisory about the vulnerability CVE-2026-65643<\/strong>, a critical flaw in the parked domains and addon domains functionality of cPanel\/WHM, a widely used administration platform in web hosting services. The vendor has not published a CVSS score; however, it classifies the issue as critical due to the impact of a successful exploitation.<\/p>\n\n The flaw allows an already authenticated cPanel account holder, with permissions to add parked or addon domains, to create arbitrary files on the server. This capability can be chained to achieve code execution with root privileges, fully compromising the underlying operating system.<\/p>\n\n As a result, an attacker could gain full control of the server and access or manipulate all hosted accounts, websites, applications, and databases. The vector requires prior authentication, but it represents a particularly high risk in shared hosting or reseller environments, where a low-privilege account could become the entry point to affect multiple customers.<\/p>\n\n As of August 28, 2026, the vendor has not reported active exploitation, published a PoC, or publicly detailed the exact component or internal mechanism that enables arbitrary write. Neither has a CVE record with official CVSS metrics been published.<\/p>\n\n It is recommended to immediately update cPanel\/WHM to the patched version corresponding to the installed branch. The vendor’s advisory and patched versions are available at the official cPanel patch.<\/a><\/p>\n\n The update can be performed from WHM, at Home > cPanel > Upgrade to Latest Version, or via SSH with root privileges using:<\/p>\n\n \/usr\/local\/cpanel\/scripts\/upcp \u2013force<\/p>\n\n Systems running unsupported versions should migrate to a supported branch to receive the fix. As a temporary measure, if updating immediately is not possible, it is advisable to restrict or disable for non-administrative accounts the ability to add parked domains and addon domains, reducing the attack surface until the update is completed.<\/p>\n\nSolution:<\/h2>\n\n
Additional information:<\/h2>\n\n
\n