Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Server

cPanel has released patches for a security flaw affecting domain parking and addon domain functionality in cPanel and WebHost Manager (WHM), which could allow code execution as the root user.

The vulnerability, assigned the CVE identifier CVE-2026-65643, impacts all supported versions of cPanel & WHM.

cPanel described the issue as a critical security vulnerability and said that an authenticated account holder who can add parked or addon domains can create arbitrary files on the server.

"Successful exploitation leads to code execution as the root user, giving an attacker full control of the server," cPanel said in a notification to customers.

cPanel has released the following patched versions -

Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Server

Other newsrooms on this story

Related reading

New cPanel Critical Flaw Could Let Hosting Customers Run SQL as Database Root

Root-Sicherheitslücke bedroht cPanel/WHM

cPanel CVE-2026-41940 Under Active Exploitation to Deploy Filemanager Backdoor

Critical cPanel, WHM flaw probs exploited as 0-day, pros say

LiteSpeed cPanel Plugin CVE-2026-48172 Exploited to Run Scripts as Root

Critical cPanel exploited: 'Millions' of sites could be hit