Threat reportVulnerabilityTL-2026-2177
CVE-2026-65643: Arbitrary File Creation in cPanel/WHM Domain Parking Leads to Root-Level Code Execution
CVE-2026-65643 (TL-2026-2177) is a critical-severity software vulnerability, first published 2026-08-28 and last reviewed 2026-08-29. It has no confirmed attribution, affects cPanel, L.L.C. (WebPros) cPanel & WHM, references 1 CVE (CVE-2026-65643), maps to 17 MITRE ATT&CK techniques (T1005, T1053.003, T1059), and is covered by 9 detection rules and 14 indicators of compromise.
- Severity
- CRITICALAssessed severity
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 17MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 14Indicators of compromise
Key facts for TL-2026-2177
- Threat ID
- TL-2026-2177
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- hosting providers, managed service providers, web hosting customers
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 14
- Updates
- 2026-08-29 · revalidated 1× · latest source
How CVE-2026-65643 works
An authenticated cPanel account holder with permission to add parked or addon domains can abuse cPanel/WHM's domain-parking functionality to create arbitrary files on the server, escalating to root-level code execution and full compromise of the hosting server. cPanel (WebPros) published the fix across all supported branches on August 27, 2026.
CVE-2026-65643 is a privilege-escalation vulnerability in the domain-parking and addon-domain functionality of cPanel & WHM, the widely deployed Linux shared-hosting control panel. Per cPanel's own advisory (mirrored by Telconet CSIRT) and corroborating reporting from GBHackers and TugaTech, any authenticated cPanel account holder who has permission to add parked or addon domains can trigger the flaw to create files at arbitrary locations on the underlying server filesystem. Because the domain-parking workflow runs with elevated process permissions, the attacker-controlled file write is leveraged to achieve code execution as root, granting complete control of the host: every hosted account, website, application, and database on that server becomes accessible to the attacker.
The published sources do not specify the exact low-level primitive (e.g., which path/filename component is under attacker control or which root-run process consumes the written file), do not include a CVSS score or vector, and do not report any public proof-of-concept exploit or confirmed in-the-wild exploitation as of publication. The reporting explicitly frames the authentication requirement as a limited safeguard in shared/reseller hosting environments, since a cPanel account (the only prerequisite) is commonly obtainable through phishing, credential stuffing, or a previously compromised account — attackers do not need any special privilege beyond a standard hosting-customer login.
cPanel (WebPros) shipped corrected builds across every actively supported release branch on August 27, 2026: 11.110.0.141, 11.134.0.53, 11.136.0.37, and 11.138.0.2, plus 11.138.1.7 for WP² (WP Squared) deployments. Telconet CSIRT's advisory additionally notes that administrators who cannot patch immediately can temporarily disable the Parked Domains and Addon Domains functions for non-administrative accounts via WHM's Feature Manager as a stopgap. This disclosure follows a pattern of high-impact cPanel/WHM vulnerabilities disclosed throughout 2026 (including an actively exploited authentication bypass and a database privilege-escalation flaw), reinforcing cPanel/WHM as a recurring target class for both vulnerability research and real-world exploitation against shared-hosting infrastructure.
MITRE ATT&CK techniques used in TL-2026-2177
Collection
Persistence
T1053.003 Scheduled Task/Job; T1098.004 Account Manipulation; T1136.001 Local Account; T1505.003 Web Shell
Execution
T1059 Command and Scripting Interpreter; T1059.004 Unix Shell
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Initial Access
T1078 Valid Accounts; T1078.003 Local Accounts; T1566 Phishing
Command and Control
Credential Access
T1110.004 Credential Stuffing; T1552 Unsecured Credentials; T1552.001 Credentials In Files
Impact
Exfiltration
Affected products and versions in CVE-2026-65643
- cPanel, L.L.C. (WebPros) — cPanel & WHM
Vulnerable versions: 11.110.x before 11.110.0.141; 11.134.x before 11.134.0.53; 11.136.x before 11.136.0.37; 11.138.x before 11.138.0.2
Fixed in: 11.110.0.141; 11.134.0.53; 11.136.0.37; 11.138.0.2 - cPanel, L.L.C. (WebPros) — WP2 (WP Squared)
Vulnerable versions: 11.138.1.x before 11.138.1.7
Fixed in: 11.138.1.7
Remediation for CVE-2026-65643
Patches
- cPanel & WHM 11.110.0.141
- cPanel & WHM 11.134.0.53
- cPanel & WHM 11.136.0.37
- cPanel & WHM 11.138.0.2
- cPanel & WHM WP2 11.138.1.7
Immediate actions
- Update cPanel & WHM to the patched build for your branch: 11.110.0.141+, 11.134.0.53+, 11.136.0.37+, or 11.138.0.2+ (11.138.1.7+ for WP² environments)
- Force the update immediately by running `upcp --force` as root from the server terminal, or triggering the update through WHM
- Where immediate patching is not possible, temporarily disable the Parked Domains and Addon Domains functions for non-administrative accounts via WHM's Feature Manager
Workarounds
- Disable the Parked Domains and Addon Domains features via WHM's Feature Manager until the update is applied
Longer-term hardening
- Restrict which reseller/user accounts are granted parked-domain and addon-domain permissions via Feature Manager and Feature Lists
- Subscribe to cPanel's security advisory feed and monitor release notes to react quickly to future Technical Security Releases (TSRs)
- Apply least-privilege account provisioning for shared-hosting customers to limit the blast radius of any single compromised cPanel account
CVEs associated with CVE-2026-65643
Weaknesses (CWE) in CVE-2026-65643
Timeline of CVE-2026-65643
- cPanel discloses and patches CVE-2026-41940, a separate, actively exploited authentication bypass in cPanel & WHM — historical context for a recurring pattern of critical cPanel security events in 2026, distinct from CVE-2026-65643.
- cPanel separately patches three additional vulnerabilities (CVE-2026-29201, CVE-2026-29202, CVE-2026-29203) per InMotion Hosting's customer advisory — again distinct from, but part of the same 2026 pattern as, CVE-2026-65643.
- At 5:30 PM ET (2130 UTC), Reclaim Hosting identifies the vulnerability affecting its cPanel/WHM-based infrastructure (Domain of One's Own, Managed Hosting, Shared Hosting) and disables creation of new subdomains, addon domains, and parked domains as a precautionary measure while patching; existing domains continue functioning normally.
- The Hacker News publishes the first public news coverage of the cPanel flaw, describing the exploitation path and patched build numbers.
- Telconet CSIRT circulated an advisory on the root privilege-escalation flaw, recommending immediate patching or, where not feasible, temporarily disabling the Parked Domains and Addon Domains functions via WHM's Feature Manager.
- Vendor guidance recommended administrators immediately force the update via `upcp --force` run as root, or trigger the update through WHM, given the vulnerability's severity.
- cPanel shipped corrected builds across all supported release branches: 11.110.0.141, 11.134.0.53, 11.136.0.37, and 11.138.0.2, plus 11.138.1.7 for WP² (WP Squared) deployments.
- cPanel (WebPros) published the official security advisory for CVE-2026-65643, disclosing an authenticated arbitrary file creation vulnerability in the domain parking / addon domain functionality of cPanel & WHM.
- CVE-2026-65643 is confirmed absent from CISA's Known Exploited Vulnerabilities catalog as of the 2026-08-27 KEV edition; no public proof-of-concept and no confirmed in-the-wild exploitation have been reported as of this date.
- cybersecuritynews.com and Rankiteo publish follow-on technical analysis reiterating the low-privilege exploitation path and detailing post-compromise blast-radius scenarios (backdoors, malware deployment, defacement, database exfiltration, lateral movement) plus hunting guidance.
- The Hacker News confirms via the CVE Program's record store that no public CVE record has yet been published for CVE-2026-65643, despite the vendor advisory and patches already being live.
- TugaTech corroborated the technical details of CVE-2026-65643, including the exact patched build numbers across all affected branches.
- GBHackers published coverage of the vulnerability, noting that authentication provides limited protection in shared-hosting environments since cPanel credentials are commonly obtainable via phishing, credential stuffing, or prior account compromise.
Update history for TL-2026-2177
- 2026-08-29 — Critical cPanel Flaw (CVE-2026-65643) Lets Hosting Customer Escalate to Root on Shared Servers: What changed No change to severity (CRITICAL), exploitability (THEORETICAL — still no PoC or confirmed exploitation), status (ACTIVE), or attribution (Unattributed/LOW). The newer report corroborates the same CVE-2026-65643 story with addit
Sources cited for CVE-2026-65643
- Critical cPanel Vulnerability Enables Attackers to Execute Root-Level Commands
- cPanel corrige vulnerabilidade crítica nos domínios parked que dá acesso root
- Security: CVE-2026-65643 - Vulnerability in cPanel's Domain Parking Functionality (August 27, 2026)
- Vulnerabilidad de escalamiento a root en cPanel & WHM
- cPanel & WHM Release Notes
Detection coverage for TL-2026-2177
As of 2026-08-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2177 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.