RCE in Webpros Cpanel

CVE-2026-65643

Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.

Affected products

Webpros Cpanel

Weakness classification (CWE)

CWE-95 — Eval Injection

Public proof-of-concept exploits

HORKimhab/CVE-2026-65643

References

support@hackerone.com

Frequently asked questions

What is CVE-2026-65643?: CVE-2026-65643 is a vulnerability in Webpros Cpanel, classified under Eval Injection. Published 2026-09-01.
Is CVE-2026-65643 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.