Critical cPanel Vulnerability Allows Attackers to Take Full Server Control

Cybersecuritynews •Guru Baran • August 28, 2026

A newly disclosed vulnerability in cPanel and WHM, the widely used web hosting control panel software, could let a low-privileged, authenticated user seize root-level control of an entire server. Tracked as CVE-2026-65643, the flaw resides in cPanel’s domain parking functionality and was publicly detailed in an advisory published on August 27, 2026, by cPanel support […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical cPanel Vulnerability Allows Full Server Control A critical vulnerability in cPanel and WHM, tracked as CVE-2026-65643, was disclosed on August 27, 2026. This flaw allows low-privileged, authenticated users to gain root-level control of the server through the domain parking functionality. Affected systems include all servers running cPanel and WHM that utilize this feature. The vulnerability poses a significant risk as it could lead to unauthorized access and control over the entire server environment. Security teams are urged to assess their systems and apply necessary patches as soon as they are available. The current status indicates that the vulnerability has been publicly disclosed, but there are no reports of active exploitation at this time. 3 sources 62

Extracted Entities

CVEs (1)

CVE-2026-65643

CWE Weaknesses (1)

CWE-269 - Improper Privilege Management