From a parked domain to server root: the critical flaw in cPanel/WHM

CVE-2026-65643: from addon domain to root execution

On August 27, 2026, cPanel published a notice about a critical vulnerability in the handling of parked domains and addon domains in cPanel and WebHost Manager. The assigned identifier is CVE-2026-65643. An authenticated user with the ability to add parked or addon domains can create arbitrary files on the server; if exploitation succeeds, this leads to code execution as the root user.

This is not a remotely exploitable flaw without credentials: a valid account with specific privileges is required. However, the privilege escalation is complete. From a single hosting customer, an attacker can gain control of the entire server, accessing data, databases, mail, and accounts of all other users. For shared hosting, resellers, and multi-user WHM installations, the risk is immediate.

The notice affects all supported versions of cPanel & WHM. WP Squared is explicitly mentioned among the corrected builds, while DNSOnly is not mentioned. No CVSS score has been assigned.

Fixed versions and update procedure

The corrected builds published on August 27, 2026 cover four main branches and one variant:

• 11.110.0.141 or later
• 11.134.0.53 or later
• 11.136.0.37 or later
• 11.138.0.2 or later
• 11.138.1.7 or later for WP Squared

It is not indicated whether branches 11.118 and 11.126, involved in a previous July patch cycle, are still supported. Servers with daily automatic updates receive the fix without manual intervention. To apply the patch immediately, you can log in as root and run /scripts/upcp --force, or from WHM follow Home > cPanel > Upgrade to Latest Version. The installed build can be verified in Server Configuration > Update Preferences. End-of-life servers must first be upgraded to a supported release to receive the fix.

What is still unknown: CVE entry, exploitation, verification

As of August 28, 2026, no CVE entry for CVE-2026-65643 had yet been published in the CVE Program registry. The cPanel notice of August 27 does not include a CVSS score. cPanel has not stated whether the vulnerability has been exploited in the wild. As of the version of the CISA Known Exploited Vulnerabilities catalog released on August 27, 2026, CVE-2026-65643 is absent.

No temporary mitigations are provided, and no procedure is indicated for checking whether a server has already been compromised. For two cPanel flaws disclosed on July 31, 2026, CVE-2026-58047 and CVE-2026-58048, entries in the NVD database were already present; for CVE-2026-65643 they were not.

KEV context: recent precedents for cPanel and LiteSpeed plugins

The CISA KEV catalog contains four entries useful for placing this series in context.

CVE-2026-41940 is an authentication bypass in cPanel/WHM with CVSS 9.8, in the catalog since April 30, 2026 with a deadline for US federal agencies of May 3, 2026 and is reported to be used in ransomware campaigns.

CVE-2026-48172 is a privilege escalation in the LiteSpeed cPanel/WHM plugin with CVSS 9.8, in the catalog since May 26, 2026 with a deadline of May 29, 2026. Exploitation in the wild was observed in May 2026. The description includes a detection command:

grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null

If it produces no output, there is no evidence of exploitation. If it produces output, suspicious IPs should be analyzed and blocked.

CVE-2026-54420 concerns improper symlink handling in the LiteSpeed plugin on CloudLinux/CageFS shared hosting, with CVSS 8.5. It has been in KEV since June 15, 2026 with a deadline of June 18, 2026 and exploitation was observed in May 2026.

For CVE-2026-58047, HTTP smuggling with possible credential leakage, and CVE-2026-58048, SQL executed in the root context during database renaming, the NVD entries do not report a CVSS score, exact versions, or KEV status.

Passenger and Plesk context

On August 14, 2026, cPanel published an advisory about a flaw in Phusion Passenger, clarifying that the issue does not affect default installations and only concerns servers with an affected Passenger package. The advisory included a command to search for signs of exploitation in Apache error logs.

On the same day, Plesk updated its own advisory with a five-point checklist; the first indicator concerns unexpected entries in /etc/ld.so.preload. Plesk reminded that applying the patch closes the vulnerability for the future but does not undo any actions already taken by an attacker.

Phusion released the fix in Passenger 6.2.0 on August 18, 2026 for a flaw in the Watchdog API without a CVE identifier and stated that it had observed exploitation in the wild at a shared hosting provider.

What to do immediately

For CVE-2026-65643, the only available action is to update to the corrected builds, starting with servers that have automatic updates disabled or are on older branches. There are no workarounds and no compromise test.

For LiteSpeed plugins, it is advisable to verify the installed versions. If a problem with CVE-2026-48172 is suspected, run the detection command indicated above and analyze any IPs found in cPanel logs. For the Passenger context, check /etc/ld.so.preload for anomalous entries and follow the Plesk checklist if the server uses that product.