← News
/DISPATCH · 2026-09-02

cPanel Discloses Critical CVE-2026-65643: Ordinary Hosting Accounts Can Escalate to Root and Seize the Server

cPanel WHM patched CVE-2026-65643: any ordinary hosting account with domain-parking rights can create arbitrary files on a multi-tenant server and execute code as root. One malicious tenant can compromise every site on the box.

CVE-2026-65643 hits shared hosting directly. cPanel WHM shipped a security update on August 27 fixing a critical flaw in Domain Parking and addon-domain features. Any authenticated user who can add parked domains can create arbitrary files on the server and ultimately execute code as root, fully taking over a multi-tenant box.

Incident Overview

Domain parking is standard in cPanel shared hosting: point extra domains at an existing site without a separate account. The underlying Park API does not constrain input enough. A regular tenant with domain-management rights can write files anywhere on the server, then chain that to root. cPanel confirmed all supported versions are affected.

Technical Details

Threat model is tenant-to-root. Shared-hosting isolation assumes tenants cannot see each other. Once one account gets root execution, that premise collapses—the attacker can read other tenants' site files, databases, SSL private keys, and mail archives, or plant malware and pivot. Initial access bar is extremely low: an ordinary hosting account.

Users on the official cPanel forum reported a compromise on August 25 (two days before the advisory) and pointed at this bug. No independent confirmation. As of August 28 the issue had no CVSS score, no formal CVE record, and was not in CISA KEV.

Impact Assessment

cPanel is one of the most widely deployed hosting control panels and runs a huge number of business sites. For multi-tenant environments this is one-account-takes-the-box. Site owners who were never targeted can still lose data if another tenant on the same server is exploited. No official confirmation of in-the-wild use, but the bar is so low that patching should not wait for scoring.

Remediation

Sources