CVE-2026-65643: cPanel Eval Injection RCE Vulnerability

CVE-2026-65643 Overview

CVE-2026-65643 is an eval injection vulnerability in cPanel version 11.138.0.0 and earlier. The flaw resides in the Park API and allows remote authenticated users to execute arbitrary code as root on the affected server. Because cPanel runs with elevated privileges to manage hosting configurations, exploitation results in full system compromise. The weakness is categorized under CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code.

Critical Impact
Authenticated cPanel users can execute arbitrary code as root through the Park API, leading to complete host takeover and lateral movement across shared hosting environments.

Affected Products

cPanel 11.138.0.0 and earlier
cPanel Park API component
Shared hosting deployments running vulnerable cPanel releases

Discovery Timeline

2026-09-01 - CVE-2026-65643 published to NVD
2026-09-03 - Last updated in NVD database
2026-08-27 - cPanel published the Park API security advisory referenced in the disclosure

Technical Details for CVE-2026-65643

Vulnerability Analysis

The vulnerability is an eval injection flaw in the cPanel Park API. The API accepts user-controlled input that flows into a dynamic code evaluation routine without sufficient neutralization. An authenticated remote user with cPanel access can craft input that the server interprets as executable code. Because cPanel service components run with root privileges, the injected code executes with the highest privileges on the host.

Exploitation requires only low-privilege authenticated access to a cPanel account. The attack vector is network-based and does not require user interaction. Successful exploitation yields high impact to confidentiality, integrity, and availability of the underlying system.

Root Cause

The root cause is unsafe dynamic evaluation of attacker-influenced strings within the Park API handler. Instead of treating parameters as inert data, the vulnerable code path passes them to a language-level evaluator such as Perl's eval construct. This pattern is the defining characteristic of CWE-95 and produces direct code execution when validation is missing.

Attack Vector

An attacker authenticates to cPanel using any valid low-privileged account, including customer or reseller accounts on shared hosting. The attacker then submits a Park API request containing crafted parameters. The vulnerable handler evaluates these parameters as code, executing them under the root context of the cPanel service. In shared hosting environments, this allows a single tenant to compromise every other tenant on the server.

See the cPanel Security Advisory CVE-2026-65643 for vendor technical details.

Detection Methods for CVE-2026-65643

Indicators of Compromise

Unexpected child processes spawned by cPanel service daemons running as root
Anomalous Park API calls in /usr/local/cpanel/logs/access_log or error_log containing unusual metacharacters or encoded payloads
Creation of new privileged accounts, cron jobs, or SSH keys shortly after Park API requests
Outbound network connections from cPanel processes to unfamiliar hosts

Detection Strategies

Alert on cPanel processes launching interpreters such as sh, bash, perl, or python outside of normal maintenance windows
Baseline legitimate Park API usage per account and flag deviations in request frequency or payload structure
Correlate authenticated cPanel sessions with subsequent privileged file writes to /etc, /root, or web roots owned by other tenants

Monitoring Recommendations

Forward cPanel access and error logs to a centralized analytics platform for retention and correlation
Monitor /scripts and /usr/local/cpanel/bin for unauthorized modifications
Track authentication events for reseller and user accounts, particularly logins from new geographies preceding API activity

How to Mitigate CVE-2026-65643

Immediate Actions Required

Upgrade cPanel to a release later than 11.138.0.0 as published in the vendor advisory
Audit all cPanel user, reseller, and API token accounts and disable any that are unused or unrecognized
Enforce multi-factor authentication for all cPanel logins to raise the bar for the authenticated precondition
Review historical Park API logs for signs of prior exploitation before patching

Patch Information

cPanel has released fixed versions addressing the Park API eval injection. Administrators should apply the update documented in the cPanel Security Advisory CVE-2026-65643. Servers using automatic updates on the RELEASE, CURRENT, or STABLE tiers receive the fix through the standard upcp process.

Workarounds

Restrict network access to cPanel management ports (2082/2083) to trusted IP ranges via host firewall or perimeter ACLs
Temporarily suspend untrusted reseller accounts until the patch is applied
Disable the Park feature for accounts that do not require it through cPanel feature lists

bash

# Update cPanel to the latest patched release
/scripts/upcp --force

# Verify the installed version
/usr/local/cpanel/cpanel -V