CVE-2026-65643

Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.

Score

CVSS 3.1 8.8 High

Status

Analyzed - support@hackerone.com

Published

2026-09-01

Last modified

2026-10-14

Weaknesses

CWE-95

Affected products

• Cpanel (Cpanel)
• Cpanel (Webpros)

References

• https://support.cpanel.net/hc/en-us/articles/42959571221527-Security-CVE-2026-65643-Park-API-Vulnerability-August-27-20…