Workflow
cPanel & WHM File Write (CVE-2026-65643)
Scan cPanel and WHM hosts for CVE-2026-65643, the domain-parking arbitrary file write that lets an authenticated account reach code execution as root.
Workflow
100%
loading
Loading content
loading
Scan cPanel and WHM hosts for CVE-2026-65643, the domain-parking arbitrary file write that lets an authenticated account reach code execution as root.
This workflow finds cPanel and WHM servers whose build predates the CVE-2026-65643 fix and sorts each host into affected or not. CVE-2026-65643 is a flaw in the domain parking and addon domain functionality of cPanel and WHM, the hosting control panel from WebPros: an authenticated account holder who can add parked or addon domains can write arbitrary files on the server, which leads to code execution as the root user. Give it hostnames, IP addresses, or CIDR ranges. The workflow port-scans each target for the cPanel service ports with naabu, reads the cpsrvd build from the unauthenticated Server response header on the ports it finds open, and compares that build against the patched build of its release branch. It returns a per-host verdict you can feed into exposure management. Detection stays read-only: a below-fix build shows patch-lag; it does not confirm the account-level precondition is met.
There is no published CVE record, CVSS score, or KEV listing for this issue as of 2026-08-28. The workflow reports what the build number shows and nothing more.
cPanel's service daemon, cpsrvd, sends its version in the Server header on the login endpoints: Server: cpsrvd/11.MINOR.REV.BUILD. A naabu port scan finds which of the cPanel service ports (2083, 2087, and 2096) are open on each target, and the check requests the login page on those, parses the four-part build, and identifies the release branch from the 11.MINOR prefix. Only cpsrvd sets that header, so the fingerprint is product-specific rather than a page keyword.
Each supported branch has its own patched build from the 2026-08-27 cPanel notification: 11.110.0.141, 11.134.0.53, 11.136.0.37, 11.138.0.2, and 11.138.1.7 for the WP Squared tier. The check looks up the fixed build for the host's branch and compares the fourth component. A build below its branch fix is marked vulnerable; a build at or above it is patched on that branch.
Branch awareness matters because a raw number sort would misjudge hosts. Build 11.136.0.37 is patched on the 11.136 branch, while 11.138.0.2 is the floor on the 11.138 branch, a lower fourth component that is still fixed. The check compares each host only to its own branch fix. A branch with no listed in-place fix, meaning anything outside 110, 134, 136, and 138, is reported as affected, because the advisory gives it no patch and every build on it needs an upgrade to a supported branch. Only a host whose cpsrvd header cannot be read is set aside as verify-manually, so the workflow never guesses a verdict it cannot support.
Server header, confirming it names cpsrvd.11.MINOR.REV.BUILD build and derive the release branch.The records below are illustrative and do not come from a real run. They show one host below its branch fix and one host patched on its own branch, so you can see the branch-aware comparison.
| url | host | port | cve | verdict | cpanel_version | branch | vulnerable | detail |
|---|---|---|---|---|---|---|---|---|
| https://host-a.example.com:2083 | host-a.example.com | 2083 | CVE-2026-65643 | vulnerable | 11.136.0.31 | 11.136 | true | build below the 11.136 branch fix 11.136.0.37 |
| https://host-b.example.org:2087 | host-b.example.org | 2087 | CVE-2026-65643 | patched | 11.138.0.2 | 11.138 | false | at or above the 11.138 branch fix 11.138.0.2 |
| https://host-c.example.net:2096 | host-c.example.net | 2096 | CVE-2026-65643 | affected_no_inplace_fix | 11.120.0.18 | 11.120 | true | branch 11.120 has no in-place fix in the advisory, upgrade to a supported branch |
{"cve": "CVE-2026-65643", "hosts_checked": 3, "affected": 2, "patched": 1, "verify_manually": 0}No. CVE-2026-65643 requires an authenticated account holder who can add parked or addon domains. A below-fix build shows patch-lag against the 2026-08-27 release. It does not confirm that an attacker holds such an account, so treat the verdict as a patching signal, since it does not prove exploitability.
Apply the fixed build for your release branch: 11.110.0.141, 11.134.0.53, 11.136.0.37, 11.138.0.2, or 11.138.1.7 for WP Squared. The daily automatic update installs it, or you can run /scripts/upcp --force to update now. End-of-life versions must upgrade to a supported branch first.
The Server: cpsrvd header is served without authentication on the cPanel service ports, so the build compare needs no credentials and stays read-only. Reading the version alone avoids touching the domain-parking function that the CVE concerns.
The advisory patches only the 110, 134, 136, and 138 branches, so a build on any other branch has no in-place fix. The check marks those hosts affected and tells you to upgrade to a supported branch. It sets a host aside as verify-manually only when the cpsrvd header cannot be read, so it never invents a verdict.
Not as of 2026-08-28. There is no published CVE record, CVSS score, or KEV entry. The finding rests on the vendor notification and the build number the header reports.
Get a personalized demo
A 30-minute walkthrough. We map the platform to your stack and answer pricing and deployment questions for your environment.