Full research report

Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Server

Original reporting ↗
★ Threat intelligence assessment medium confidence

Executive assessment

CVE-2026-65643 is the latest in a run of critical privilege-boundary failures across the cPanel ecosystem in 2026, arising after the actively exploited authentication bypass (CVE-2026-41940) and two LiteSpeed plugin privilege escalations (CVE-2026-48172 and CVE-2026-54420) that are confirmed in CISA's KEV catalogue and linked to ransomware operators. The new flaw is particularly severe in shared hosting contexts where a single tenant account — potentially obtained through credential stuffing or phishing — could escalate to root and compromise every co-hosted site on the server. The absence of a published CVE record, CVSS score, or interim mitigation other than patching raises operational risk for defenders who rely on those signals to triage remediation queues. The recurring pattern of session-handling and file-write flaws across cPanel's codebase — affecting the core control panel, third-party plugins, and the Exim mail transfer agent — suggests systemic weaknesses in how the platform mediates between tenant-level input and root-privilege operations, making shared hosting infrastructure a sustained high-value target for the ransomware operators already demonstrably familiar with this attack surface.

What happened

On August 27, 2026, cPanel issued a customer notification disclosing CVE-2026-65643, a critical vulnerability in cPanel and WHM's domain parking and addon domain management functionality. An authenticated account holder with permission to add parked or addon domains can write arbitrary files on the server, leading to code execution as the root user. cPanel released patched builds across its active 110, 134, 136, and 138 release trains simultaneously. As of August 28, 2026, no formal CVE record or CVSS score had been published, and cPanel made no statement on whether exploitation had occurred.

Affected scope

All supported versions of cPanel & WHM across the 11.110, 11.134, 11.136, and 11.138 release trains, and WP Squared. End-of-life versions remain unpatched with no remediation path other than version upgrade. The 11.118 and 11.126 branches — covered in July 2026 advisories — are not mentioned in the August 27 notification, leaving their support status ambiguous. Risk is highest in shared hosting environments where a single tenant account could be used to compromise all co-hosted sites, databases, and email on the server.

Technical assessment

The flaw lies in cPanel's handling of parked and addon domain creation. Insufficient path validation during domain record creation allows an authenticated user to write files to arbitrary filesystem locations. Because cPanel's management services operate with root privileges, writing a file to an executed path results in code running as root. The precise injection vector has not been made public. This class of flaw — authorised low-privilege input reaching a privileged file-write operation without adequate path restriction — echoes earlier cPanel weaknesses, including the LiteSpeed plugin symlink chain (CVE-2026-54420) and the Exim .forward privilege escalation disclosed in July 2026.

Recommended defensive actions

  1. Patch immediately: apply cPanel & WHM 11.110.0.141, 11.134.0.53, 11.136.0.37, 11.138.0.2, or WP Squared 11.138.1.7 by running /scripts/upcp --force as root, or via WHM > Home > cPanel > Upgrade to Latest Version.
  2. Verify the installed build under WHM > Server Configuration > Update Preferences to confirm the correct patched version is running before marking the host as remediated.
  3. Restrict parked and addon domain permissions to only the accounts that operationally require them, as a defence-in-depth measure while patching proceeds across a fleet.
  4. Audit file system integrity for unexpected files outside standard cPanel account home directories, particularly in web-accessible, cron-executed, or cPanel hook paths, which may indicate prior exploitation.
  5. Patch CVE-2026-41940, CVE-2026-48172, and CVE-2026-54420 as a priority if not already done; all three carry confirmed active exploitation and CISA KEV designations, with CVE-2026-41940 linked to ransomware campaigns.

Uncertainties and evidence gaps

  • No CVE record for CVE-2026-65643 had been published as of August 28, 2026, so no CVSS score, CWE classification, or NVD analysis is yet available to independently assess severity.
  • cPanel has not stated whether Team User sub-accounts holding parked or addon domain permissions are within the attack scope, which affects the effective attack surface calculation.
  • The support status of cPanel branches 11.118 and 11.126 is unconfirmed following the August 27 advisory, which did not list patched builds for those branches.
  • Whether any in-the-wild exploitation of CVE-2026-65643 has occurred is unknown; cPanel made no disclosure and CISA had not added it to KEV as of the August 27 catalogue version.
  • The supplied reporting identifies CVE-2026-58047, but the reviewed sources did not establish its distinct role in this event.
  • The supplied reporting identifies CVE-2026-58048, but the reviewed sources did not establish its distinct role in this event.

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessAuthenticated cPanel account holder with permission to add parked or addon domains — a common shared hosting capability
ComponentDomain parking and addon domain management functionality within cPanel and WHM
MechanismInsufficient path validation during domain record creation permits arbitrary file writes to locations outside the account's intended filesystem boundary
ImpactCode execution as root, yielding full server compromise including all co-hosted accounts, databases, email, and configuration
DetectionFile integrity monitoring alerts on unexpected files outside standard account home directories; anomalous domain management API calls from low-privilege accounts; WHM audit logs for unusual domain creation events at scale or from accounts without legitimate business need
MitigationUpgrade to cPanel 11.110.0.141, 11.134.0.53, 11.136.0.37, 11.138.0.2, or WP Squared 11.138.1.7; no interim workaround other than restricting domain-parking permissions has been published
Exploitation status

No confirmed exploitation of CVE-2026-65643 as of August 28, 2026; it is absent from CISA KEV and cPanel has made no statement on in-the-wild activity. Of the other CVEs in this story: CVE-2026-41940 was previously exploited as a zero-day from approximately February 2026 and is linked to ransomware campaigns; CVE-2026-48172 and CVE-2026-54420 were previously exploited in the wild and added to CISA KEV in May and June 2026 respectively.

Research process

The investigation began with the August 28, 2026 Hacker News report on CVE-2026-65643, a newly disclosed critical cPanel flaw with no published CVE record or CVSS score. Primary research confirmed the advisory content and established that exploitation of CVE-2026-65643 itself is unconfirmed. The investigation then pivoted to the three related cPanel-ecosystem CVEs already in the CISA KEV catalogue — CVE-2026-41940, CVE-2026-48172, and CVE-2026-54420 — to establish the broader attack surface and threat actor context. Independent verification from Rapid7, watchTowr, LiteSpeed, and CyberScoop corroborated the KEV designations and confirmed ransomware use of CVE-2026-41940, supporting a medium-confidence assessment that the new flaw is unconfirmed for exploitation but sits within a high-tempo attack campaign against cPanel infrastructure.

  1. What does the primary report say about CVE-2026-65643, its mechanism, and exploitation status?
    Fetched The Hacker News article published August 28, 2026
    thehackernews.com ↗

    CVE-2026-65643 is a critical arbitrary file write in domain parking and addon domain functionality, leading to root RCE. No CVE record published, no CVSS score, absent from CISA KEV as of August 27. Patched builds listed for 110, 134, 136, and 138 branches; WP Squared included.

    why Established the core event and confirmed that exploitation status is undisclosed by cPanel, setting the research direction toward corroboration and related CVE context.

  2. Is there an independent vendor advisory or CVE record for CVE-2026-65643?
    Searched for CVE-2026-65643 across advisory and vulnerability database sources

    No NVD or CVE Programme record existed as of August 28, 2026. cPanel's disclosure was a customer notification rather than a public advisory; Rankiteo published a secondary summary confirming the same patch versions and attack vector.

    why Confirmed the absence of formal CVE metadata, which limits independent severity scoring and makes patch verification the primary defensive signal.

  3. What is the full technical picture of CVE-2026-41940, which CISA KEV associates with ransomware?
    Fetched Rapid7 emergency threat response post on CVE-2026-41940
    rapid7.com ↗

    CVE-2026-41940 is a CRLF injection chained with a session-encryption bypass allowing unauthenticated root-session injection. CVSS 9.8. All cPanel versions after 11.40 vulnerable. Approximately 1.5 million exposed instances. Zero-day exploitation confirmed from approximately February 23, 2026.

    why Established the severity and zero-day timeline for the most dangerous related vulnerability, explaining the EPSS score of 0.985 and CISA KEV ransomware designation.

  4. Has watchTowr published a PoC and confirmed the pre-patch exploitation mechanism?
    Fetched watchTowr Labs technical deep-dive on CVE-2026-41940
    labs.watchtowr.com ↗

    watchTowr published a three-request exploitation chain: CRLF injection via Basic auth password field, encryption-skip via malformed cookie, then cache-promotion of injected session fields. Detection artefact generator released. In-the-wild exploitation confirmed prior to the April 28 patch.

    why Confirmed PoC availability for CVE-2026-41940 and validated the pre-patch zero-day assertion; reinforced why this CVE dominates the EPSS percentile ranking.

  5. What are the technical details and confirmed exploitation of CVE-2026-48172 in the LiteSpeed cPanel plugin?
    Fetched LiteSpeed vendor security advisory and GitHub Advisory Database record
    blog.litespeedtech.com ↗

    CVE-2026-48172 affects LiteSpeed user-end cPanel plugin v2.3–2.4.4. Any cPanel user can invoke lsws.redisAble to execute arbitrary code as root. Actively exploited at disclosure on May 19, 2026. Fixed in v2.4.7 bundled with WHM plugin v5.3.1.0. Detection: grep for 'cpanel_jsonapi_func=redisAble' in cPanel logs.

    why Vendor confirmation of active exploitation and a concrete log-based detection command substantiate the CISA KEV addition and provide an actionable defensive signal.

  6. What are the scope and CISA KEV status of CVE-2026-54420?
    Fetched BleepingComputer report on CISA's second LiteSpeed plugin KEV addition
    bleepingcomputer.com ↗

    CVE-2026-54420 is a symlink-following flaw in LiteSpeed cPanel plugin before 2.4.8, requiring FTP or web shell access on a server running CloudLinux or CageFS. CISA added it June 15, 2026. Fixed in v2.4.8.

    why Corroborated the KEV source material and clarified a narrower exploitation prerequisite compared to CVE-2026-48172, informing the affected-scope assessment.

  7. Has ransomware use of CVE-2026-41940 been independently confirmed beyond the CISA KEV note?
    Fetched CyberScoop reporting and Tenable CVE record for CVE-2026-41940
    cyberscoop.com ↗

    CyberScoop confirmed active exploitation and emergency port-blocking by Namecheap and KnownHost. Tenable record notes ransomware campaigns using the flaw and over 40,000 servers reported compromised; .sorry file extension identified as a ransomware artefact.

    why Two independent sources corroborated the CISA KEV ransomware designation, elevating confidence that threat actors are actively targeting cPanel infrastructure and are familiar with this attack surface.

  8. What are CVE-2026-58047 and CVE-2026-58048, the July 31 cPanel flaws referenced in the article?
    Searched for both CVEs across advisory and news sources

    CVE-2026-58047 is HTTP request smuggling in cpsrvd (CVSS 5.6); CVE-2026-58048 is database privilege escalation via database rename in MySQL/MariaDB (CVSS 9.4). Both disclosed July 31, 2026. Neither is in CISA KEV. CVE records are published.

    why Contextualised the pattern of recurring privilege-boundary failures across cPanel's service layer; CVE-2026-58048's critical CVSS warrants ongoing monitoring for exploitation activity.

Named in this story
Actorsunattributed ransomware operators
Malwareransomware with .sorry file extension (associated with CVE-2026-41940 exploitation campaigns)
Targetsshared web hosting providersmanaged and reseller hosting infrastructurefederal civilian executive branch agencies (CISA binding directive scope)websites hosted on multi-tenant cPanel servers
Related CVEs CVE-2026-65643CVE-2026-41940CVE-2026-48172CVE-2026-54420CVE-2026-58047CVE-2026-58048

Research coverage

All 73 registered source leaves were evaluated for this run: 66 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 7 registered sources supplied useful evidence (4 primary, 2 corroborating, 1 contextual and 0 PoC/exploit references). 59 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 73 sources
SourceRun resultValueWhy it was useful — or not
BleepingComputernews ok9 records Primary evidence1 matched items Supplied a vendor or government advisory opened and verified during focused research.
CISA KEVkev ok1685 records Primary evidence3 matched items Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue.
Rapid7news ok2 records Primary evidence1 matched items Supplied a vendor or government advisory opened and verified during focused research.
The Hacker Newsnews ok13 records Primary evidence1 matched items Published the source report used to frame and date the event.
CISA Alertsnews ok empty0 records Corroborating1 matched items A page from this source was opened and verified during focused research.
NVDcve ok900 records Corroborating1 matched items A page from this source was opened and verified during focused research.
FIRST EPSSepss ok Context3 matched items Added exploitation-probability context; EPSS does not itself prove exploitation.
AlienVault OTXdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
CERT-EU Threat Intelligencenews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory ok5333 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok264 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok687 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1012 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok15 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok12 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok18 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1591 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP Galaxyresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
SentinelLabsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos X-Opsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
The DFIR Reportnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Unit 42news ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok4 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
WeLiveSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Additional verified pages 8 opened outside the registered collection
References & evidence
Vulnerability & exploitation6
CVE-2026-54420 CISA KEV LiteSpeed cPanel Plugin · added 2026-06-15 CISA catalog ↗
CVE-2026-48172 CISA KEV LiteSpeed cPanel Plugin · added 2026-05-26 CISA catalog ↗
CVE-2026-41940 CISA KEV WebPros cPanel & WHM and WP2 (WordPress Squared) · added 2026-04-30 · used in ransomware CISA catalog ↗
CVE-2026-41940 EPSS 98.5% 100th percentile exploitation probability
CVE-2026-48172 EPSS 18.9% 97th percentile exploitation probability
CVE-2026-54420 EPSS 1.4% 71th percentile exploitation probability
PoC & exploit code1
The Internet Is Falling Down: cPanel & WHM Authentication Bypass CVE-2026-41940 — watchTowr Labs labs.watchtowr.com ↗

Step-by-step technical analysis and detection artefact generator for CVE-2026-41940; no public PoC exists for CVE-2026-65643

Vendor & gov advisories3
LiteSpeed cPanel Plugin Security Update — LiteSpeed Blog blog.litespeedtech.com ↗

Vendor advisory for CVE-2026-48172 confirming active exploitation, detailing patched versions and log-based detection command

CVE-2026-41940 Emergency Threat Response — Rapid7 rapid7.com ↗

Comprehensive affected-version matrix, CVSS 9.8 confirmation, and exploitation scale for CVE-2026-41940

CISA Warns of Another Actively Exploited cPanel Plugin Flaw — BleepingComputer bleepingcomputer.com ↗

Reports CISA KEV addition of CVE-2026-54420 on June 15, 2026 and exploitation prerequisites for CloudLinux/CageFS environments

Analysis & research3
cPanel Authentication Bypass Exploited in the Wild — CyberScoop cyberscoop.com ↗

Independent reporting on zero-day exploitation timeline and emergency port-blocking responses from major hosting providers

CVE-2026-41940 — Tenable CVE Record tenable.com ↗

Aggregated CVSS, EPSS (0.985) and exploitation status record; notes ransomware use and over 40,000 servers reported compromised

GHSA-fxrh-cwjh-m33v — GitHub Advisory Database (CVE-2026-48172) github.com ↗

Primary advisory record for CVE-2026-48172 in the LiteSpeed user-end cPanel plugin, confirming CVSS 10.0 and affected version range