Get in touch
, ,

cPanel and Plesk root flaws: is your hosting server patched?

Hosting servers with a warning triangle, illustrating cPanel and Plesk root vulnerabilities

If you run a shared hosting server, two recent control panel flaws deserve your attention. Both cPanel and Plesk have fixed bugs that let an ordinary hosting customer take full root control of the server, and with it every website and mailbox on it.

cPanel & WHM: CVE-2026-65643

cPanel published this advisory on 27 August 2026. The flaw is in domain parking and addon domains. A logged-in cPanel user who can add parked or addon domains can write files anywhere on the server and run code as root. It affects every supported version of cPanel & WHM. It isn’t open to the whole internet, but on a server with many customers, one compromised account is enough.

The first fixed builds for each branch are:

  • 11.110: 11.110.0.141
  • 11.134: 11.134.0.53
  • 11.136: 11.136.0.37
  • 11.138: 11.138.0.2
  • WP Squared: 11.138.1.7

Servers with automatic daily updates will already have the fix. To check, run /usr/local/cpanel/cpanel -V as root, and if you’re behind, update with /scripts/upcp --force. Servers on an end-of-life branch need moving to a supported one.

Plesk: CVE-2026-67394

Plesk for Linux had a similar problem. A customer or reseller with shell access, or permission to change their own shell access, could escalate to root. It’s fixed in Plesk 18.0.79.9 and 18.0.80.5. If you can’t update straight away, Plesk’s advice is to set shell access to Forbidden for customers and resellers.

Plesk also fixed CVE-2026-65642, which could let a logged-in user reach databases belonging to other users on the same server.

Earlier this year: Exim

If you haven’t updated recently, also check your mail server. cPanel shipped Exim 4.99.2 earlier in 2026 to fix four Exim flaws (CVE-2026-40684 to CVE-2026-40687), one of them rated critical.

What to do

  • Check your panel version today and update if needed.
  • Keep automatic updates switched on for cPanel or Plesk.
  • Only give customers shell access when they really need it.
  • Review the server for unknown accounts, cron jobs or root-owned files if it was unpatched for a long time.

I build, secure and maintain cPanel/WHM and Plesk servers, including keeping them patched against flaws like these. See my server administration service or get in touch for a security check.

Sources

Related posts