# CVE-2026-65643: Arbitrary File Creation in cPanel/WHM Domain Parking Leads to Root-Level Code Execution

> An authenticated cPanel account holder with permission to add parked or addon domains can abuse cPanel/WHM's domain-parking functionality to create arbitrary files on the server, escalating to root-level code execution and full compromise of the hosting server. cPanel (WebPros) published the fix across all supported branches on August 27, 2026.

- **Published:** 2026-08-28T00:00:00Z
- **Last reviewed:** 2026-08-29T10:44:57.966Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2177
- **ID:** TL-2026-2177
- **Severity:** CRITICAL
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 14 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-65643

## Description

CVE-2026-65643 is a privilege-escalation vulnerability in the domain-parking and addon-domain functionality of cPanel & WHM, the widely deployed Linux shared-hosting control panel. Per cPanel's own advisory (mirrored by Telconet CSIRT) and corroborating reporting from GBHackers and TugaTech, any authenticated cPanel account holder who has permission to add parked or addon domains can trigger the flaw to create files at arbitrary locations on the underlying server filesystem. Because the domain-parking workflow runs with elevated process permissions, the attacker-controlled file write is leveraged to achieve code execution as root, granting complete control of the host: every hosted account, website, application, and database on that server becomes accessible to the attacker.

The published sources do not specify the exact low-level primitive (e.g., which path/filename component is under attacker control or which root-run process consumes the written file), do not include a CVSS score or vector, and do not report any public proof-of-concept exploit or confirmed in-the-wild exploitation as of publication. The reporting explicitly frames the authentication requirement as a limited safeguard in shared/reseller hosting environments, since a cPanel account (the only prerequisite) is commonly obtainable through phishing, credential stuffing, or a previously compromised account — attackers do not need any special privilege beyond a standard hosting-customer login.

cPanel (WebPros) shipped corrected builds across every actively supported release branch on August 27, 2026: 11.110.0.141, 11.134.0.53, 11.136.0.37, and 11.138.0.2, plus 11.138.1.7 for WP² (WP Squared) deployments. Telconet CSIRT's advisory additionally notes that administrators who cannot patch immediately can temporarily disable the Parked Domains and Addon Domains functions for non-administrative accounts via WHM's Feature Manager as a stopgap. This disclosure follows a pattern of high-impact cPanel/WHM vulnerabilities disclosed throughout 2026 (including an actively exploited authentication bypass and a database privilege-escalation flaw), reinforcing cPanel/WHM as a recurring target class for both vulnerability research and real-world exploitation against shared-hosting infrastructure.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1078.003 Local Accounts
- T1566 Phishing
- T1110.004 Credential Stuffing
- T1552 Unsecured Credentials
- T1552.001 Credentials In Files
- T1059.004 Unix Shell
- T1505.003 Web Shell
- T1136.001 Local Account
- T1005 Data from Local System
- T1059 Command and Scripting Interpreter
- T1053.003 Scheduled Task/Job
- T1098.004 Account Manipulation
- T1068 Exploitation for Privilege Escalation
- T1105 Ingress Tool Transfer
- T1567 Exfiltration Over Web Service
- T1491.002 Defacement

## Sources

- [Critical cPanel Vulnerability Enables Attackers to Execute Root-Level Commands](https://gbhackers.com/critical-cpanel-vulnerability/)
- [cPanel corrige vulnerabilidade crítica nos domínios parked que dá acesso root](https://tugatech.com.pt/t89969-cpanel-corrige-vulnerabilidade-critica-nos-dominios-parked-que-da-acesso-root)
- [Security: CVE-2026-65643 - Vulnerability in cPanel's Domain Parking Functionality (August 27, 2026)](https://support.cpanel.net/hc/en-us/articles/42959571221527-Security-CVE-2026-65643-Vulnerability-in-cPanel-s-Domain-Parking-Functionality-August-27-2026)
- [Vulnerabilidad de escalamiento a root en cPanel & WHM](https://csirt.telconet.net/comunicacion/noticias-seguridad/vulnerabilidad-de-escalamiento-a-root-en-cpanel-whm/)
- [cPanel & WHM Release Notes](https://docs.cpanel.net/release-notes/release-notes/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2177