CVE-2026-65643
Full vulnerability record from the local CVENow database.
Description
Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.
Severity
HIGH
CVSS score
8.7
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-09-01 03:16:50.807000
Last modified
2026-11-03 23:17:52.380000
View original CVE JSON
{
"id": "CVE-2026-65643",
"sourceIdentifier": "[email protected]",
"published": "2026-09-01T03:16:50.807",
"lastModified": "2026-11-03T23:17:52.380",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "WebPros",
"product": "cPanel",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "11.110.0.141",
"versionType": "semver",
"status": "affected"
},
{
"version": "11.112.0.0",
"lessThan": "11.134.0.53",
"versionType": "semver",
"status": "affected"
},
{
"version": "11.136.0.0",
"lessThan": "11.136.0.37",
"versionType": "semver",
"status": "affected"
},
{
"version": "11.138.0.0",
"lessThan": "11.138.0.2",
"versionType": "semver",
"status": "affected"
},
{
"version": "11.138.1.0",
"lessThan": "11.138.1.7",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-10-14T03:56:23.735550Z",
"id": "CVE-2026-65643",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-95"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "110.0.141",
"matchCriteriaId": "7447D72E-DD18-4494-94A3-39709524C9CD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "112.0.0",
"versionEndExcluding": "134.0.53",
"matchCriteriaId": "6319ECA1-FF30-4F9B-9CEA-842FD4EBECFD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "136.0.0",
"versionEndExcluding": "136.0.37",
"matchCriteriaId": "F2420432-F464-44DE-AA7D-7639B0A03D8E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "138.0.0",
"versionEndExcluding": "138.0.2",
"matchCriteriaId": "550849BE-3041-4F16-AAA3-D877A868DC08"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "138.1.0",
"versionEndExcluding": "138.1.7",
"matchCriteriaId": "5F387D47-C49F-4C9D-AA4B-E2EEECD03E98"
}
]
}
]
}
],
"references": [
{
"url": "https://support.cpanel.net/hc/en-us/articles/42959571221527-Security-CVE-2026-65643-Park-API-Vulnerability-August-27-2026",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}