CVE-2026-65643

EUVD-2026-68922
Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.
Eval Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 58.16%
Affected Products (NVD)
VendorProductVersion
cpanelcpanel
𝑥
< 110.0.141
cpanelcpanel
112.0.0 ≤
𝑥
< 134.0.53
cpanelcpanel
136.0.0 ≤
𝑥
< 136.0.37
cpanelcpanel
138.0.0 ≤
𝑥
< 138.0.2
cpanelcpanel
138.1.0 ≤
𝑥
< 138.1.7
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://support.cpanel.net/hc/en-us/articles/42959571221527-Security-CVE-2026-65643-Park-API-Vulnerability-August-27-2026