Vulnerability in cPanel’s domain parking functionality - CVE-2026-65643

A critical security vulnerability affecting cPanel & WHM has been identified. Patched versions are now available.

Vulnerability in cPanel’s domain parking functionality - CVE-2026-65643

Situation: An authenticated cPanel account holder who is able to add parked or addon domains can create arbitrary files on the server.

Impact: Successful exploitation leads to code execution as the root user, giving an attacker full control of the server.

Affected Versions:

• cPanel & WHM – all supported versions

Patched Versions:

• 11.110.0.141 or later
• 11.134.0.53 or later
• 11.136.0.37 or later
• 11.138.0.2 or later
• 11.138.1.7 or later (WP Squared)

Support Link: Security: CVE-2026-65643 Vulnerability in cPanel’s Domain Parking Functionality - August 27, 2026 – cPanel

Action Required > Update cPanel now

Servers configured for automatic daily updates will receive the patched build automatically. To apply it immediately, log in to the server as root and run /scripts/upcp --force. Alternatively:

1. Log in to cPanel
2. Go to WHM > Home > cPanel > Upgrade to Latest Version
3. Install the latest cPanel update
4. Verify the installed version in WHM under Server Configuration > Update Preferences.

If your server is running an end-of-life version, upgrade to a supported version to receive this fix.

Our support team is available if you have any questions or need further guidance.

Best regards,

Your cPanel Security Team