CVE-2026-65643 is a high severity (CVSS 8.8) eval injection in cPanel. The record says versions 11.138.0.0 and earlier let a remote authenticated user execute arbitrary code as root. cPanel published an advisory about its Park API on 27 August 2026. Update cPanel to the fixed build named in that advisory.
What's affected
The record lists cPanel 11.138.0.0 and earlier as affected. It describes the flaw as eval injection, which it maps to CWE-95. The advisory title, taken from the reference URL in the record, is "Security CVE-2026-65643 Park API Vulnerability August 27 2026", so the weak spot sits in the Park API.
I could not open the cPanel advisory from my environment, because the support site returned a browser challenge page instead of the article. That means I cannot quote a fixed version. Do not guess one. Read the cPanel article and match your update tier against it.
The record also does not say which cPanel release tiers received a backport. If you run a long-lived tier, assume nothing until the advisory says so.
How to check if you're exposed
Run the version command on each server, and compare it with the advisory:
/usr/local/cpanel/cpanel -V
The vulnerability needs an authenticated user, so exposure is higher where many people hold accounts. Shared hosting servers, reseller setups and any server where customers get cPanel logins are the main concern. A server with a single trusted administrator is lower risk, though not zero, since a stolen credential would be enough.
Look at who can log in and from where. Review accounts you did not create, passwords that were reused across services, and any panel that is reachable from the whole internet.
What to do now
- Read the cPanel advisory for CVE-2026-65643 and note the fixed build for your release tier.
- Update cPanel and WHM through the normal upgrade path, then confirm the new version with the command above.
- Review accounts and remove any that are unused or unknown.
- Turn on two factor authentication for panel accounts where your setup supports it.
- If a server ran an affected version with untrusted account holders, check it for unexpected processes, cron jobs and new root level changes.
Why it matters
Eval injection is a class of code injection. Input from a user reaches a function that evaluates it as code, so the attacker's text is executed instead of treated as data. Here the record says the code runs as root, which is the strongest position on a Linux server.
The attack needs a login, and that lowers the risk compared with an unauthenticated flaw. It also means a hosting provider cannot treat its customers as trusted, because each customer account is a potential starting point. A privilege boundary between panel users and root is the whole point of a hosting panel, and this class of bug removes it.
No source I reviewed says this CVE is exploited in the wild, and the record's KEV flag is false. The cPanel advisory is the right place to confirm that for your build.
Quick check
Can a customer account trigger this?
The record says a remote authenticated user can trigger it. Any account that can reach the panel is a candidate, so hosting providers should treat this as urgent.
What version fixes it?
I could not read the advisory, so I cannot name one. The record says 11.138.0.0 and earlier are affected, so use the fixed build in cPanel's own article.
Sources
- cPanel advisory on CVE-2026-65643, Park API, August 27 2026 (could not be opened from my environment)
- NVD record for CVE-2026-65643
Last reviewed: 18 October 2026.
