cPanel released patches on August 27 for a critical flaw that could let an authenticated account holder gain full root access to a server, but the advisory stops short of telling administrators how to check whether an attacker already got in.
The vulnerability, which carries the identifier CVE-2026-65643, sits in how cPanel and WHM handle domain parking and addon domains. According to cPanel, any account holder with permission to add parked or addon domains can create arbitrary files on the server, and from there, exploitation leads directly to code execution as root, giving an attacker full control of the machine.
The fix covers versions 11.110.0.141, 11.134.0.53, 11.136.0.37, 11.138.0.2, and 11.138.1.7 for WP Squared. Notably, the advisory doesn’t mention DNSOnly, and it leaves open whether older branches, specifically 11.118 and 11.126, which cPanel patched separately back in July, still receive support. Servers set to update automatically will get the fix without administrators needing to do anything. Everyone else can force it manually by running /scripts/upcp –force as root, or through WHM’s upgrade panel.
What the notification doesn’t include matters just as much as what it does. It carries no CVSS score, and as of August 28, the CVE Program’s official record store still hadn’t published an entry for CVE-2026-65643, even though it already listed two other cPanel flaws from July. cPanel also hasn’t said whether anyone has exploited this vulnerability, and CISA’s Known Exploited Vulnerabilities catalog doesn’t include it, at least for now.
That gap matters given cPanel’s own track record. In a separate advisory from earlier in August covering a Phusion Passenger flaw, the company included a command administrators could run to check Apache error logs for signs of prior exploitation. Plesk, which WebPros develops alongside cPanel, went further, publishing a five-item checklist for spotting compromise. No equivalent guidance accompanies this latest patch.
Administrators now have a fix. Whether they needed one sooner is a question the advisory leaves unanswered.
