{"id":"CVE-2026-65643","title":"Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.","summary":"Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-95"],"vendor":"cpanel","product":"cpanel","affected":["cpanel < 110.0.141","cpanel >= 112.0.0, < 134.0.53","cpanel >= 136.0.0, < 136.0.37","cpanel >= 138.0.0, < 138.0.2","cpanel >= 138.1.0, < 138.1.7"],"patched":["cpanel 138.1.7"],"published":"2026-09-01","updated":"2026-09-17","sourceUpdated":"2026-09-17T15:09:53.750","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-65643","references":[{"url":"https://support.cpanel.net/hc/en-us/articles/42959571221527-Security-CVE-2026-65643-Park-API-Vulnerability-August-27-2026","label":"support@hackerone.com"}],"tags":["nvd","exploit-available"],"epss":0.00904,"epssPercentile":0.57774,"exploits":{"github":2,"githubRepos":["https://github.com/tc4dy/CVE-2026-65643-PoC-Toolkit","https://github.com/HORKimhab/CVE-2026-65643"],"checkedAt":"2026-09-21T15:30:08.820Z"},"exploitAvailable":true,"ingestedAt":"2026-09-05T19:43:56.479Z","slug":"CVE-2026-65643","body":"## Overview\n\nEval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.\n\n## Affected\n\n- `cpanel < 110.0.141`\n- `cpanel >= 112.0.0, < 134.0.53`\n- `cpanel >= 136.0.0, < 136.0.37`\n- `cpanel >= 138.0.0, < 138.0.2`\n- `cpanel >= 138.1.0, < 138.1.7`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `cpanel 138.1.7`","depth":"midnight","depthScore":61,"depthScoreParts":{"impact":48.4,"likelihood":0.2,"exploitation":12,"ransomware":0},"changes":[{"seq":5407,"id":"CVE-2026-65643","ts":1788887280852,"field":"exploit_available","old":"false","new":"true"},{"seq":4290,"id":"CVE-2026-65643","ts":1788886394866,"field":"exploit_available","old":"true","new":"false"},{"seq":3039,"id":"CVE-2026-65643","ts":1788883058608,"field":"exploit_available","old":"false","new":"true"},{"seq":2068,"id":"CVE-2026-65643","ts":1788882463337,"field":"exploit_available","old":"true","new":"false"},{"seq":1141,"id":"CVE-2026-65643","ts":1788881899743,"field":"exploit_available","old":"false","new":"true"}]}