According to the CVE record published on 1 September 2026 (02:07 UTC; 10:07 am Perth; HackerOne CNA), CVE-2026-65643 is an eval injection (CWE-95) in cPanel 11.138.0.0 and earlier that allows remote authenticated users to execute arbitrary code as root. The record lists cPanel as affected before 11.110.0.141, from 11.112.0.0 before 11.134.0.53, from 11.136.0.0 before 11.136.0.37, from 11.138.0.0 before 11.138.0.2 and from 11.138.1.0 before 11.138.1.7, and rates it CVSS 4.0 8.7 High (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).

CISA's enrichment of the record lists proof-of-concept exploitation, not active exploitation. cPanel's own advisory, linked here, returns 403 to Cyberstack. This is not the April login bypass (CVE-2026-41940), which is already on Cyberstack. (source: CVE record)

Correction (27 Oct 2026): removed details that came only from cPanel's advisory, which Cyberstack cannot read: the parked- and addon-domain file-creation mechanism, the WP Squared product name, the line that all supported versions are affected, and the advisory's statements on scoring and exploitation; the CVE record's CVSS 4.0 score is now given. The card date has moved from 27 August to 1 September 2026, the Perth date of the CVE record (1 September, 02:07 UTC; 10:07 am Perth (AWST)). (source: CVE.org)