CVE-2026-65643

State: Published
Severity: 8.7 High
Published: Sep 1, 2026
Updated: Oct 14, 2026
Reserved: Jul 22, 2026

Description

Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	hackerone

Weaknesses

CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

Affected Products

Product	Versions
cPanelWebPros	before 11.110.0.141Affected 11.112.0.0 to before 11.134.0.53Affected 11.136.0.0 to before 11.136.0.37Affected 11.138.0.0 to before 11.138.0.2Affected 11.138.1.0 to before 11.138.1.7Affected

References

https://support.cpanel.net/hc/en-us/articles/42959571221527-Security-CVE-2026-65643-Park-API-Vulnerability-August-27-2026

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.