CVE-2026-65643 - Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root

HIGH

Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root

Published Sep 1, 2026

8.7

HIGH

CVSS 4.0

EPSS 0.88%

Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

unaffected

No remediation recorded yet.

Weaknesses (1)

CWE-95

Link	Providers	Tags
https://support.cpanel.net/hc/en-us/articles/42959571221527-Security-CVE-2026-65643-Park-API-Vulnerability-August-27-2026		Vendor Advisory

No recorded changes yet.

Sources

Status PUBLISHED

Assigner hackerone

Published Sep 1, 2026

Updated Sep 2, 2026

Reserved Jul 22, 2026

Updated Sep 1, 2026

Status Analyzed

Modified Sep 17, 2026

Severity n/a

Public date n/a