Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Server

A critical security flaw in cPanel's domain parking and addon domain functionality could allow one hosting customer to gain root control of an entire server. The vulnerability affects all supported versions of cPanel and WebHost Manager and could enable code execution as the root user. cPanel has released patches to address the issue, which has been assigned the CVE identifier CVE-2026-65643. The company considers the vulnerability to be critical. The flaw impacts the security of cPanel and WebHost Manager. Patches have been made available to fix the issue.