CVE-2026-65643

highpriority · attend · 45EPSS 0.009 · 59 %ileexploit · PoCDEUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

2 exploits · PoC

Likely / severe?

0.88% (59th) EPSS

CVSS 8.8 · high

Is it mine?

15 products

Check your exposure

Who says so?

2 sources

cert_bund · nvd

EPSS · scored 2026-10-27

Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.

cvss

Technical severity, 0–10. One row per scoring source.

8.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 2.8 · impact 5.9

v4.08.7highCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · support@hackerone.com

v4.07.4highCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-95US

exploits (2)

Public proof-of-concept and weaponised exploit code.

affected products (15)

Products and version ranges known to be affected.

cPanel cPanel/WHM <11.110.0.14all versionscert_bundDE
cPanel cPanel/WHM <11.134.0.53all versionscert_bundDE
cPanel cPanel/WHM <11.136.0.37all versionscert_bundDE
cPanel cPanel/WHM <11.138.0.2all versionscert_bundDE
cPanel cPanel/WHM WP2 <11.138.1.7all versionscert_bundDE
cPanel cPanel/WHM≤ WP2 <11.138.1.7cert_bundDE
cPanel cPanel/WHM< 11.110.0.14cert_bundDE
cPanel cPanel/WHM< 11.134.0.53cert_bundDE
cPanel cPanel/WHM< 11.136.0.37cert_bundDE
cPanel cPanel/WHM< 11.138.0.2cert_bundDE
cpanel cpanel< 110.0.141nvdUScpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*
cpanel cpanel112.0.0 → 134.0.53nvdUScpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*
cpanel cpanel136.0.0 → 136.0.37nvdUScpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*
cpanel cpanel138.0.0 → 138.0.2nvdUScpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*
cpanel cpanel138.1.0 → 138.1.7nvdUScpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-3061cPanel cPanel/WHM: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit AdministratorrechtenDeutsch2026-08-27csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in cPanel cPanel/WHM ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen.

sources

Which sources assert this record, and when.

cert_bund nvd NVD CVE.org MITRE

published 2026-09-01modified 2026-09-03

references (1) nvd

External citations — patches, advisories, analysis.

https://support.cpanel.net/hc/en-us/articles/42959571221527-Security-CVE-2026-65643-Park-API-Vulnerability-August-27-2026

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan