{"id":"CVE-2026-65643","title":"Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.","summary":"Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-95"],"vendor":"cpanel","product":"cpanel","affected":["cpanel < 110.0.141","cpanel >= 112.0.0, < 134.0.53","cpanel >= 136.0.0, < 136.0.37","cpanel >= 138.0.0, < 138.0.2","cpanel >= 138.1.0, < 138.1.7"],"patched":["cpanel 138.1.7"],"published":"2026-09-01","updated":"2026-10-14","sourceUpdated":"2026-10-14T04:18:24.863","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-65643","references":[{"url":"https://support.cpanel.net/hc/en-us/articles/42959571221527-Security-CVE-2026-65643-Park-API-Vulnerability-August-27-2026","label":"support@hackerone.com"}],"tags":["nvd","exploit-available","cve.org"],"epss":0.00875,"epssPercentile":0.58776,"exploits":{"github":2,"githubRepos":["https://github.com/tc4dy/CVE-2026-65643-PoC-Toolkit","https://github.com/HORKimhab/CVE-2026-65643"],"checkedAt":"2026-10-27T19:07:40.372Z"},"exploitAvailable":true,"ingestedAt":"2026-09-05T19:43:56.479Z","ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-09-01T00:00:00+00:00"},"scores":{"nvd":8.8,"cna":8.7},"slug":"CVE-2026-65643","body":"## Overview\n\nEval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.\n\n## Affected\n\n- `cpanel < 110.0.141`\n- `cpanel >= 112.0.0, < 134.0.53`\n- `cpanel >= 136.0.0, < 136.0.37`\n- `cpanel >= 138.0.0, < 138.0.2`\n- `cpanel >= 138.1.0, < 138.1.7`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `cpanel 138.1.7`","depth":"midnight","depthScore":61,"depthScoreParts":{"impact":48.4,"likelihood":0.2,"exploitation":12,"ransomware":0},"changes":[{"seq":5407,"id":"CVE-2026-65643","ts":1788887280852,"field":"exploit_available","old":"false","new":"true"},{"seq":4290,"id":"CVE-2026-65643","ts":1788886394866,"field":"exploit_available","old":"true","new":"false"},{"seq":3039,"id":"CVE-2026-65643","ts":1788883058608,"field":"exploit_available","old":"false","new":"true"},{"seq":2068,"id":"CVE-2026-65643","ts":1788882463337,"field":"exploit_available","old":"true","new":"false"},{"seq":1141,"id":"CVE-2026-65643","ts":1788881899743,"field":"exploit_available","old":"false","new":"true"}]}