cPanel has patched CVE-2026-65643, a flaw in its domain parking and addon domain functionality that lets an ordinary hosting customer write files anywhere on the server and escalate to root.
Today, cPanel has released the advisory, which affects all supported versions of cPanel & WHM and WP Squared.
The bug sits in the code path that runs when an authenticated account holder adds a parked or addon domain — a routine action enabled by default for most shared hosting customers. Abusing it produces arbitrary file creation, and from there, according to cPanel's advisory, code execution as the root user
. WebPros has not published a CVSS score, a CWE class, or a researcher credit.
How the cPanel Domain Parking Flaw Works
Parking a domain is not a database-only operation. cPanel writes DNS zone data, Apache virtual host entries, and userdata files on the account's behalf, and parts of that work run with elevated privileges. Control over what gets written, and where, is what turns a customer feature into a root primitive. cPanel has not said which component performs the write or what the patch validates, so the exact mechanism is unconfirmed.
Which cPanel Versions Are Affected
| Branch | Patched build |
|---|---|
| cPanel & WHM 11.110.0 | 11.110.0.141 or later |
| cPanel & WHM 11.134.0 | 11.134.0.53 or later |
| cPanel & WHM 11.136.0 | 11.136.0.37 or later |
| cPanel & WHM 11.138.0 | 11.138.0.2 or later |
| WP Squared (WP2) | 11.138.1.7 or later |
Earlier 2026 advisories carried fixed builds for the 11.118.0 and 11.126.0 branches. This one does not, so servers on those tiers have no build number to target and no in-place patch to apply. The advisory still says all supported versions are affected, which makes silence on a branch very different from safety on it. Administrators on those lines should open a ticket.
How to Patch and Verify
/usr/local/cpanel/scripts/upcp --force /usr/local/cpanel/cpanel -V
Customers without root access should ask their provider for the running build number rather than accept a general assurance. cPanel has published no workaround. As an interim control, Cyber Kendra suggests resellers strip the Parked Domains and Addon Domains features from customer feature lists in WHM — existing domains keep resolving, and users only lose the ability to add new ones.
The Other cPanel Root Bug This Month
This is the second privilege escalation reachable from a paid account in four weeks. Earlier in August, cPanel patched CVE-2026-58048, rated 9.4 under CVSS 4.0, where any customer with the MySQL feature enabled could run database commands with full administrative privileges because SQL mode was not preserved during a database rename. WebPros warned that the damage could reach the operating system.
There is no public proof-of-concept, no CISA KEV listing and no report of exploitation from cPanel or hosting providers at the time of writing. April's CVE-2026-41940 was in use for roughly two months before a patch existed, so the quiet stretch after an advisory is a patch window, not evidence of safety.