—–BEGIN PGP SIGNED MESSAGE—–

Hash: SHA256

Remote Code Execution Vulnerability in cPanel

Indian – Computer Emergency Response Team (https://www.cert-in.org.in)

Severity Rating: HIGH

Software Affected

cPanel & WHM (Web Host Manager) Versions: 

prior to 11.110.0.141

prior to 11.134.0.53

prior to 11.136.0.37

prior to 11.138.0.2

WP2 Versions prior to 11.138.1.7

Overview

A vulnerability has been reported in cPanel’s Domain Parking functionality which could allow a remote authenticated users to execute arbitrary code as root giving an attacker full control of the server.

Target Audience:

Individuals and organizations using affected cPanel hosting environment.

Risk Assessment:

High risk of remote code execution and sensitive data exposure.

Impact Assessment:

Unauthorized access and full server compromise.

Description

cPanel & WHM is a web hosting control panel that provides administrative (WHM) and user-level (cPanel) interfaces for managing servers and websites.

This vulnerability exists in cPanels Domain Parking functionality due to insufficient restrictions on file creation.

Successful exploitation of this vulnerability could allow a remote authenticated users to execute arbitrary code as root giving an attacker full control of the server.

Solution

Apply appropriate updates as mentioned:

https://support.cpanel.net/hc/en-us/articles/42959571221527-Security-CVE-2026-65643-Vulnerability-in-cPanel-s-Domain-Parking-Functionality-August-27-2026

Vendor Information

 

https://www.cpanel.net/

References

 

https://support.cpanel.net/hc/en-us/articles/42959571221527-Security-CVE-2026-65643-Vulnerability-in-cPanel-s-Domain-Parking-Functionality-August-27-2026

CVE Name

CVE-2026-65643

 

– —

Thanks and Regards,

CERT-In

Incident Response Help Desk

e-mail: incident@cert-in.org.in

Phone: +91-11-22902657

Toll Free Number: 1800-11-4949

Toll Free Fax : 1800-11-6969

Web: http://www.cert-in.org.in

PGP Fingerprint: A768 083E 4475 5725 B81A A379 2156 C0C0 B620 D0B4

PGP Key information:

https://www.cert-in.org.in/s2cMainServlet?pageid=CONTACTUS

Postal address:

Indian Computer Emergency Response Team (CERT-In)

Ministry of Electronics and Information Technology

Government of India

Electronics Niketan

6, C.G.O. Complex

New Delhi-110 003

—–BEGIN PGP SIGNATURE—–

iQIzBAEBCAAdFiEE6r4Iam/Ey0c/KakL3jCgcSdcys8FAmqYKQ0ACgkQ3jCgcSdc

ys+EoBAAkenL1S4U6CastPrfI3v/gJPOJz8bGi5wmCxSmdGPZhixg7rZoPwhU8wt

dn755OJdGHZL3NWDrw8Ok1TuqesJrrIaxIUUeV3szuGOTHfPNEs/A50x6FHUM9XL

/LxE8PaoE4Uyvn+B1AVEjvRjC5iZOlGypz2pDAGqYZF8haTRHT4ie2MRynr145F2

+/WWOlDYkOHNaEixYAXPpA2LKaaeWQtJX4XsxMk+MIsEJpfjkJ2ITkjAmqKnUoqF

qghd+mc0Y3CjUPPDc9Wic7mKX8TVZNLcOXW+9PwiN8tNQ/cS4PrITip8AUWNNawO

WEVzIHgsOpfPsnVpcK6lVRXyVApRyL+KkA7f7f8V2IuVj1CWbQWJc6JblZyoGcof

w01KHR3s7rMVRJosdmcJJAC9lVzn3TaPaeKOZK8mliwUcswT6ZsO5loVaTNU2521

050IGCH4t606rMU614mu256o4Fd8WrqK5maFCOFAzgyzTDL6TZN4qlq+RQgJwKqS

jqiZSXpieSTVvSH4aucIa3dfLPKTZ2GXUBvGUSoDyfSMa49zwL69NOuDj4rc7RqE

wASSLtSekoK97dr/cydD/8Sw0ov0RLCuTK70vjc+3ULxtEMUPaREXb05AjNZDpC1

JmI/baA67qyRz/lTW4T2ivnVezJ6WEAOEgheVMrO2R9o9HfsA6M=

=qHUQ

—–END PGP SIGNATURE—–