Critical cPanel Flaw Could Allow Hosting Customer to Gain Root Control of Entire Server

cPanel has released security updates to address a critical vulnerability affecting the domain parking and addon domain functionality within cPanel and WebHost Manager (WHM). The vulnerability, identified as CVE-2026-65643, impacts all supported versions of the cPanel & WHM platform.

According to cPanel's advisory, the issue stems from insufficient input validation or permission handling within the domain management modules. An attacker who gains access to a hosting customer's account could exploit this weakness to execute arbitrary code with root privileges. Successful exploitation could lead to complete compromise of the hosting server, exposing and potentially altering the data of all accounts hosted on that server.

cPanel has classified the severity of this flaw as critical and urges all users to apply the available patches immediately. The company stated that no active exploitation of CVE-2026-65643 had been reported at the time of disclosure, though the nature of the vulnerability presents a significant risk to multi-tenant hosting environments.

The patches address the underlying code flaw in the domain parking and addon domain features. Administrators are advised to update their cPanel & WHM installations to the latest released versions to mitigate the risk.