CVE-2026-65643: patch the cPanel domain parking root vulnerability

cPanel has released emergency builds for CVE-2026-65643, a critical vulnerability in cPanel & WHM's domain parking functionality. An authenticated cPanel account that can add parked or addon domains may be able to create arbitrary files on the server. Successful exploitation can lead to code execution as root and complete server compromise.

All supported cPanel & WHM versions were listed as affected in cPanel's 27 August 2026 security advisory. Do not assume that restricting WHM access protects the server: the vulnerable operation is available to ordinary cPanel accounts when their feature permissions allow domain aliases or addon domains.

Affected and patched builds

Update to at least the fixed build for your branch:

A later build in the same supported branch also contains the fix. If the server is on an end-of-life branch, move it to a supported release; an unsupported installation cannot be considered patched merely because automatic updates are enabled.

Check the installed cPanel version

Run this as root:

/usr/local/cpanel/cpanel -V

Compare the complete version with the table above. For example, 11.136.0.36 remains vulnerable, while 11.136.0.37 or later in that branch contains the hotfix.

You can also check in WHM under Server Configuration > Update Preferences.

Install the hotfix immediately

Servers configured for automatic daily updates should receive a patched build, but cPanel recommends applying this critical fix immediately rather than waiting for the next scheduled run:

/scripts/upcp --force

Alternatively, in WHM go to Home > cPanel > Upgrade to Latest Version, install the latest available update, and verify the resulting build again.

What to review after patching

The update closes the known vulnerability but cannot undo a prior compromise. If an affected server allowed customers to create parked or addon domains, review it for unexpected privileged changes:

• recently created or modified files in root-owned and executable paths;
• unfamiliar root SSH keys, administrator accounts, or sudoers entries;
• unexpected services, cron jobs, systemd units, and startup scripts;
• suspicious cPanel account activity and domain additions;
• unexplained outbound connections or newly listening services.

If you find indicators of compromise, isolate the server, preserve evidence, rotate privileged credentials from a trusted system, and rebuild from known-good sources where appropriate.

Next steps

• cPanel update tiers explained
• CVE-2026-33278: check the cpanel-unbound DNSSEC RCE
• cPanel license tiers explained

Keeping a current cPanel license allows supported servers to receive security hotfixes through the normal update channel.