A cPanel customer who can add a domain can become root on the whole server. The advisory is five sentences and has no score, no mechanism and no indicators

What cPanel disclosed

On 27 August 2026, cPanel published a security advisory for CVE-2026-65643. Here is essentially all of it:

An authenticated cPanel account holder who is able to add parked or addon domains can create arbitrary files on the server.

Successful exploitation leads to code execution as the root user, giving an attacker full control of the server and every account, website, and database on it.

That is the substance. There is a table of fixed build numbers and a link to a generic update page, and nothing else. For a flaw that takes an ordinary hosting customer to root on a shared server, the disclosure is about five sentences long.

The multi-tenancy problem in one line

Read the entry condition again, because it is the whole story: an authenticated account holder who can add parked or addon domains. Adding a domain is not a privileged operation. It is a routine, low-tier feature enabled by default on shared and reseller plans, and it is one of the things people buy hosting to do.

So the cost of entry is a legitimate account, purchasable for a few pounds a month, or obtained by compromising one existing customer. From there, per the vendor’s own words, an attacker reaches "full control of the server and every account, website, and database on it."

That is precisely the boundary shared hosting sells. Every tenant on that machine is relying on the platform to keep the others out, and this crossed it in the most mundane way available.

What the advisory does not say

The anatomy of a thin advisory

The gaps are worth listing precisely, because each one removes an option from a defender.

No mechanism. The advisory does not explain how an arbitrary file write becomes root code execution. Anyone describing that step is inferring, including us; we will not.

No CVSS, no CWE, and no published CVE record. At the time of writing, CVE-2026-65643 exists only as a reserved identifier: the CVE services return no published record, the National Vulnerability Database has no entry, and even the assigning authority is not public. There is no score to feed a risk register and no weakness class to route it by.

No credit. Nobody is named as the finder. Worth flagging, because some coverage has named a "Devon Courtney" as having detailed the flaw: that is the author of the vendor’s support article, not a researcher.

No workaround and no indicators. There is no mitigation short of patching, and nothing to hunt with if you want to know whether this was used against you before you updated.

This is a choice rather than a limitation, and the evidence is cPanel’s own recent practice. Its July identifiers were published with full CVSS 4.0 vectors, CWE assignments and a named finder. Two months later, the more serious flaw comes with none of that.

Two branches got no fix, and nobody has said why

Patched builds, by branch

Branch	Fixed build	Confirmed in the public changelog
110	11.110.0.141	Yes, 27 August 2026
134	11.134.0.53	Yes, 27 August 2026
136	11.136.0.37	Yes, 27 August 2026
138	11.138.0.2	Yes, 27 August 2026
WP Squared	11.138.1.7	No, the public changelog stops at 138.1.6

Now the part that should worry anyone running an older branch. cPanel’s May 2026 release notes describe a security update issued for "all supported cPanel and WHM versions (136, 134, 132, 130, 126, 124, 118, 110, 102, 94, and 86)." The August advisory covers four: 110, 134, 136 and 138.

Checking the public changelogs, branch 118 last received a build on 30 July and branch 126 on 29 July. Neither got a 27 August release. cPanel has not said whether those branches are now end of life. If you are on 118 or 126, you cannot currently tell from public information whether you are unaffected, unsupported, or simply waiting.

What is not known

One practical correction. Some coverage states that servers on automatic updates receive the patch daily, and attributes this to the advisory. The advisory says nothing about automatic updates, and cPanel’s own documentation says security updates are applied hourly by cron, though that cron does nothing if the update repository is disabled or the server is pinned to a specific version. If you rely on auto-update, verify the build rather than assuming.

The most useful response came from a host, not the vendor

With no workaround offered, one hosting provider published its own. Reclaim Hosting announced on the evening of 27 August that it had temporarily disabled the ability to create new subdomains, addon domains and parked domains on affected servers, noting that existing domains were unaffected.

That is the shape of the correct mitigation, and it came from an operator reasoning from the entry condition rather than from the advisory, which offered no such guidance. If you run a multi-tenant estate and cannot patch immediately, suspending the domain-add capability removes the documented path.

What to do

The position

An advisory has two audiences. One patches, and for them a version table is enough. The other has to decide how fast to move, whether they were already hit, and what to do in the days before a change window opens. This advisory serves only the first.

The gaps compound in a way that is worth naming. Without a mechanism, you cannot reason about whether your configuration is exposed. Without a CVSS or a CWE, the flaw does not flow through the tooling most organisations use to prioritise. Without indicators, you cannot check whether it already happened. And without a published CVE record, it may not even appear in the feeds your programme watches. A serious flaw that is hard to see is, in practice, a flaw that gets patched late.

This site has repeatedly found that the artefacts security teams treat as ground truth answer narrower questions than assumed. This is the sharper version of the same problem: the artefact is not narrow, it is nearly empty, and the industry will still route decisions through it. The vendor has done the important thing by shipping fixes across four branches on the same day. What it has not done is give its customers enough to act on anything except the patch, and for the many who cannot patch tonight, that gap is the whole of their exposure.