cPanel released patches this week for CVE-2026-65643, a critical vulnerability in its domain management features that allows unprivileged hosting customers to execute code as the root user on shared servers.
The flaw affects domain parking and addon domain functionality across all supported versions of cPanel & WHM. An attacker with a standard hosting account could exploit this vulnerability to gain complete control over the entire server, compromising every other customer's data and applications running on that hardware.
cPanel classified the issue as critical, acknowledging the severity of the threat. The vulnerability stems from insufficient privilege isolation in how cPanel handles domain operations. When customers add parked or addon domains through the control panel interface, the system processes these requests with root-level permissions. An attacker can inject malicious code into these domain configuration processes that executes with the same elevated privileges, bypassing normal user restrictions.
The impact extends far beyond a single hosting account. Shared hosting environments typically run dozens or hundreds of customer websites on one physical server. Root access means an attacker gains read and write permissions to all files, databases, and configurations on that server. They can modify other customers' websites, steal databases containing payment information or personal data, install persistent backdoors for long-term access, or launch attacks against other targets using the server's resources.
Hosting providers operating cPanel infrastructure face immediate pressure to deploy patches. The vulnerability affects all supported versions, meaning no version escapes the flaw. cPanel has released patches for the affected versions, but deployment falls to thousands of individual hosting providers worldwide. Many small and mid-sized hosting companies operate with limited security teams, potentially delaying patch deployment.
The vulnerability differs from typical remote code execution flaws because it requires only a basic hosting account. An attacker does not need sophisticated exploits or zero-day knowledge. The attack surface includes any hosting provider using cPanel, and the attacker simply registers an account like any legitimate customer.
cPanel serves an estimated two million servers worldwide, making this vulnerability potentially one of the highest-impact hosting infrastructure flaws in recent years. The hosting industry relies heavily on cPanel's market dominance, meaning a single critical flaw cascades across thousands of independent hosting providers and millions of websites.
Administrators should immediately verify patch deployment status with their hosting providers. Customers hosting sites on shared cPanel servers should contact their providers and confirm patches have been applied. Organizations running cPanel in private deployments should apply patches without delay.
The vulnerability underscores a persistent challenge in shared hosting security. Privilege isolation failures continue to emerge in popular control panels despite decades of security practice. Multi-tenant environments demand flawless separation between customer accounts, yet implementation mistakes regularly create pathways for lateral privilege escalation.