cPanel CVE-2026-65643

Exploitation requires possession of a valid cPanel user account with at least low-privilege access - any legitimate tenant, reseller, or sub-account credential is sufficient. The vulnerable component is the Park API (domain parking functionality), which is a core, default-enabled cPanel feature; no non-standard configuration is required to expose the attack surface. The CVSS PR:L metric confirms that unauthenticated exploitation is not possible - the attacker must first obtain or compromise valid cPanel credentials. Physical or local server access is not required; exploitation is fully remote over the network. There is no user-interaction requirement. The primary limiting factor for exploitation at scale is the need for a valid credential, which in a shared hosting context may be obtained through phishing, credential stuffing, or purchasing access to compromised accounts.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) reflects a network-reachable, low-complexity attack requiring only a low-privilege authenticated session - consistent with any valid cPanel tenant or reseller account. The complete VC/VI/VA impact triad at High reflects full server compromise once exploitation succeeds. EPSS data is not provided in the input, and the vulnerability is not currently listed in the CISA KEV catalog, leaving real-world exploitation probability unconfirmed. The HackerOne disclosure origin suggests coordinated responsible disclosure with a vendor fix available, reducing (but not eliminating) immediate exploitation risk. The primary risk amplifier is cPanel's broad deployment across shared and managed hosting infrastructure: a single compromised low-privilege account could yield root access over an entire multi-tenant server, affecting every co-hosted site and their data. This is a genuine priority for any organization operating cPanel-based infrastructure.

An attacker holding a valid low-privilege cPanel account - such as a shared hosting tenant - crafts a malicious request to the Park API endpoint, injecting code into a parameter that is processed by a dynamic evaluation function without sanitization. The injected payload executes within the cPanel process context, which operates as root, granting the attacker full control of the underlying server. From this position, the attacker can exfiltrate all hosted site data across every tenant, install persistent backdoors, or manipulate DNS and web service configuration. No public exploit code has been identified at time of analysis.