Critical cPanel Flaw: Root Control Vulnerability Puts Shared Hosting Servers at Risk
Critical cPanel Flaw Could Hand Attackers Full Server Root Control
A newly disclosed vulnerability in cPanel and WebHost Manager allows an authenticated user to seize complete control of a shared hosting server — putting thousands of websites at risk.
cPanel released emergency patches on August 27, 2026, for a critical security flaw tracked as CVE-2026-65643 that affects domain parking and addon domain functionality across all supported versions of cPanel and WebHost Manager (WHM). The vulnerability could allow any authenticated hosting customer to execute code as the root user and take over an entire server.
For the millions of businesses and individuals who rely on shared hosting environments powered by cPanel — one of the most widely deployed web hosting control panels in the world — this flaw represents a significant and immediate threat. A single compromised or malicious tenant on a shared server could effectively own every other account on that same machine. Understanding the broader implications for protecting your website and online infrastructure has never been more pressing.
What the Vulnerability Does and Who Is at Risk
According to cPanel's notification to customers, an authenticated account holder with permission to add parked or addon domains can create arbitrary files on the server. The consequences are severe.
"Successful exploitation leads to code execution as the root user, giving an attacker full control of the server," cPanel stated in its advisory.
The vulnerability impacts all supported versions of cPanel and WHM. cPanel has released patched builds across five version branches to address the issue:
- 11.110.0.141 or later
- 11.134.0.53 or later
- 11.136.0.37 or later
- 11.138.0.2 or later
- 11.138.1.7 or later (WP Squared)
The August 27 advisory covers the 110, 134, 136, and 138 branches. Notably, cPanel has not clarified whether the 11.118 and 11.126 branches — which appeared in July patch advisories — remain supported or are covered by this fix.
The notification also does not specify whether a Team User sub-account with permission to manage parked and addon domains falls within the vulnerability's scope. This ambiguity leaves hosting administrators with incomplete information when assessing their exposure. Conducting a structured vulnerability assessment across your hosting environment is a practical first step toward quantifying that exposure while official clarification remains outstanding.
The Shared Hosting Risk Multiplier
What makes this flaw particularly dangerous is its context. Shared hosting environments, by design, consolidate dozens or hundreds of separate customer accounts onto a single physical or virtual server. The isolation between those accounts depends entirely on the integrity of the underlying system. Once an attacker achieves root-level execution, that isolation collapses entirely.
A malicious actor — or a legitimate user whose credentials have been stolen — needs only a single hosting account with addon or parked domain permissions to compromise every other tenant on the server. That means customer databases, email archives, SSL private keys, and application source code belonging to entirely unrelated businesses could be extracted or manipulated without those businesses ever being aware an intrusion occurred.
What No CVSS Score Means for Administrators
The customer notification carries no CVSS score. The Hacker News confirmed on August 28, 2026, via the CVE Program's record store that no formal CVE record has yet been published for CVE-2026-65643. By contrast, CVE records for two cPanel flaws disclosed on July 31 — CVE-2026-58048 and CVE-2026-58047 — were present at the time of the check.
The absence of a CVSS score is not merely a bureaucratic detail. Security teams in many organisations use CVSS thresholds to prioritise patching workflows. Without a published score, automated vulnerability management tools may not flag CVE-2026-65643 as requiring urgent attention — even though the described impact, root-level code execution on a multi-tenant server, places it firmly in the critical category by any reasonable assessment. Administrators should not wait for a formal score before acting.
cPanel has not confirmed whether this vulnerability has been actively exploited. As of the CISA Known Exploited Vulnerabilities (KEV) catalog version released on August 27, 2026, CVE-2026-65643 does not appear in the catalog.
How to Apply the Patch and What Administrators Should Know
Servers configured for automatic daily updates will receive the patched build without manual intervention. However, administrators who need to act immediately can apply the fix by logging into the server as root and running the following command:
/scripts/upcp --force
The update can also be applied through the WHM dashboard by navigating to Home > cPanel > Upgrade to Latest Version. Administrators can verify the installed build under Server Configuration > Update Preferences. Servers running an end-of-life version of cPanel must first upgrade to a supported version before the patch can be applied.
What the Advisory Does Not Tell You
The current CVE-2026-65643 advisory provides no interim mitigation and no method for administrators to determine whether a server has already been compromised. This is a meaningful gap. cPanel's own advisory published on August 14, 2026, covering the Phusion Passenger vulnerability, included specific indicators of compromise and a structured detection checklist. The August 27 advisory offers neither.
Plesk's advisory for the Passenger flaw made the point directly: "Patching closes the vulnerability going forward, but it does not undo anything an attacker may have already done."
That principle applies with equal force here. Administrators should treat the patch as a necessary but incomplete response. In the absence of official guidance, reviewing server logs for unusual file creation activity in domain-related directories is the most actionable starting point currently available.
Reducing the Attack Surface Before and After Patching
One practical measure available to administrators regardless of patch status is auditing which hosted accounts carry permission to add parked or addon domains. This vulnerability requires that specific permission to be exploitable. Accounts that do not need it should have it removed.
Applying the principle of least privilege — ensuring users hold only the permissions their role requires — directly limits the pool of accounts from which this attack could be launched. This is not a substitute for patching, but it materially reduces exposure on servers where patching may be delayed. A deeper understanding of role-based access control and how to implement it effectively provides a practical framework for tightening those permissions across hosted environments.
A Pattern of Critical cPanel Flaws in 2026
This disclosure is part of a broader pattern of serious security issues affecting cPanel infrastructure throughout 2026. CISA's KEV catalog already carries two flaws tied to the LiteSpeed cPanel plugin.
CISA added CVE-2026-48172 on May 26, 2026 — a privilege escalation flaw in the LiteSpeed cPanel plugin that allows any cPanel user to execute arbitrary scripts with root privileges. On June 15, 2026, CISA added CVE-2026-54420, a symlink-following vulnerability in the same plugin affecting shared hosting servers running CloudLinux or CageFS. The catalog also lists CVE-2026-41940, an authentication bypass patched in April 2026 with confirmed use in ransomware campaigns.
The Phusion Passenger Disclosure and What It Did Better
Earlier in August, cPanel and Plesk — both developed by WebPros — published advisories related to a Phusion Passenger vulnerability. Phusion shipped a fix in Passenger 6.2.0 on August 18, 2026, for a Watchdog API flaw that does not carry a CVE identifier.
"We have seen exploitation of this vulnerability in the wild at a shared hosting provider," Phusion said in its disclosure.
Plesk's advisory for the same flaw included a five-item checklist for detecting prior compromise, beginning with unexpected entries in /etc/ld.so.preload. The contrast with the August 27 cPanel advisory is notable. Where Plesk offered structured compromise detection guidance, the CVE-2026-65643 notification offers none. For administrators responsible for servers carrying the data of dozens or hundreds of tenants, that gap translates directly into uncertainty about whether their environment is already affected.
What the 2026 Pattern Signals
Taken together, the 2026 disclosures — covering privilege escalation, symlink abuse, authentication bypass, and now arbitrary file creation leading to root execution — reflect a sustained period of scrutiny on shared hosting control panel software. The attack surface presented by these platforms is substantial: they are widely deployed, handle privileged system operations on behalf of unprivileged users, and sit at the intersection of hosting provider infrastructure and customer-controlled data.
For security teams managing hosted infrastructure, the pattern reinforces the case for treating control panel software with the same patch urgency applied to operating system and hypervisor updates. Waiting for CVSS scores or KEV catalog entries before acting on critical advisories from vendors like cPanel introduces a lag that sophisticated attackers are positioned to exploit.
With root-level access on shared hosting servers carrying the data of dozens or hundreds of tenants, the stakes for unpatched systems remain high. Administrators running supported cPanel versions should verify their patch status immediately and audit server activity for signs of unauthorised file creation or privilege escalation.
