Skip to main content

Vulnerability in cPanel’s domain parking functionality - CVE-2026-65643

Amit Kalra

Surprised to see No mentions of this here.
Our server got hacked with this security lapse on 25th August 2026, and Cpanel notified me on mail about this on 27th August 2027.

 
 

A critical security vulnerability affecting cPanel & WHM has been identified. Patched versions are now available.

 

Vulnerability in cPanel’s domain parking functionality - CVE-2026-65643

 

Situation: An authenticated cPanel account holder who is able to add parked or addon domains can create arbitrary files on the server.

 

Impact: Successful exploitation leads to code execution as the root user, giving an attacker full control of the server.

 

Affected Versions:

  • cPanel & WHM – all supported versions

Patched Versions:

  • 11.110.0.141 or later
  • 11.134.0.53 or later
  • 11.136.0.37 or later
  • 11.138.0.2 or later
  • 11.138.1.7 or later (WP Squared)

Support Link: Security: CVE-2026-65643 Vulnerability in cPanel’s Domain Parking Functionality - August 27, 2026 – cPanel

 

Action Required > Update cPanel now

 

Servers configured for automatic daily updates will receive the patched build automatically. To apply it immediately, log in to the server as root and run /scripts/upcp --force. Alternatively:

  1. Log in to cPanel
  2. Go to WHM > Home > cPanel > Upgrade to Latest Version
  3. Install the latest cPanel update
  4. Verify the installed version in WHM under Server Configuration > Update Preferences.

If your server is running an end-of-life version, upgrade to a supported version to receive this fix.

Our support team is available if you have any questions or need further guidance.

 

Best regards,

Your cPanel Security Team



Comments

5 comments

Date Votes
  • cPRex Jurassic Moderator

    Hey there!  How were you able to confirm this was the specific issue that led to your compromise?

    0
  • Amit Kalra

    Our reason for suspecting it is that the attack sequence we observed closely matches the exploitation path described in the advisory.

    Our Root SSH is allowed only through keys, not through password.
    We have only 1 WHM account, which has access is only with 2FA.

    At the time of the incident, the server was running cPanel 136.0.36. We had a compromised cPanel account, followed by the creation of identical 1337.txt files in numerous unrelated cPanel accounts on August 25. Most of these appeared at approximately the same time, and there was also a root-owned /home/1337.txt. On August 26 we subsequently observed root WHM/API activity and a remote root WHM session.

    The important correlation is that the newly disclosed vulnerability allows an authenticated cPanel account to create arbitrary files and ultimately obtain code execution as root. This provides a plausible explanation for the transition we observed from cPanel-account-level access to root access.

    Thankfully we got notified in time, and could mitigate the damage. We had to remove a lot of things but after that the server has been stable for 72 hrs.

    We have since upgraded from 136.0.36 to 136.0.37.

    We therefore suspect this vulnerability was the mechanism used, but we would like to know what cPanel-specific forensic evidence would allow us to confirm or rule this out. In particular, which cPanel logs record domain parking/addon-domain operations or the file creation associated with this vulnerability?

    0
  • cPRex Jurassic Moderator

    Thanks for the additional details.  At this point we aren't sharing any additional information about the vulnerability publicly so I'm not able to answer that.  

    0
  • Amit Kalra

    Our Server was updated to 136.0.36 on 27th August 2026, and since then on a few nights, our httpd service restarted.
    We are still investigating what caused it as the server load was very less. It seems this happened when the Cpanel Update script ran. 
    In the meanwhile we there was another Cpanel update, and our Cpanel is now updated to 136.0.38
    I have been managing Cpanel Servers hosted at hetzner for the last 20 years. On 2-3 previous occasions we could create tickets on Cpanel for support.
    During this past week, when I tried to create a ticket with Cpanel support, I could not do so with the message that since this Cpanel license is not directly through Cpanel, tickets are not allowed.
    Is that a new policy, that tickets will be allowed only if licensed are got directly through cpanel and not if the licenses are through Data Centers.
    We are paying over 50 Euros / Month for Cpanel License, and it is unfair and sad to know that even after paying a high license fees we will not get support from Cpanel.
    Earlier when license fees was 20-25Euros / Month cPanel used to allow tickets and support. Now cost of License is doubled over the last few years and support discontinued.
    I am seriously thinking of move away from Cpanel with this kind of policy.
    cPRex can you confirm when this change in policy for support to licenses through Data Center happened ?

    0
  • cPRex Jurassic Moderator

    That ticket policy has been in place for over two years now, so it's not a recent change.  Our policy has always been to reach out to your license provider first, as they should be offering you some level of support as part of the license agreement.  If they aren't able to resolve the issue they can escalate the ticket to us.

    More details on this can be found here: https://support.cpanel.net/hc/en-us/community/posts/35919412082327-Confusion-around-Partner-Support-licenses-and-contacting-cPanel-support

     

    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post