CVE-2026-65643

Executive Summary

CVE-2026-65643 is an Eval injection vulnerability affecting cPanel versions 11.138.0.0 and earlier, allowing remote authenticated users to execute arbitrary code as the root user. The vulnerability carries a CVSS score of 8.8 (High) and is classified under CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code). Successful exploitation grants full root-level compromise of the hosting server, affecting confidentiality, integrity, and availability. The flaw is remotely exploitable with low attack complexity, requiring only low-privilege authentication with no user interaction, making it a high-priority target for enterprise environments operating cPanel-based hosting infrastructure.

Technical Analysis

CVE-2026-65643 belongs to the CWE-95 — Improper Neutralization of Directives in Dynamically Evaluated Code vulnerability class, commonly referred to as Eval injection or Code Injection via the eval() family of functions. The NVD description indicates that the flaw exists in cPanel 11.138.0.0 and earlier versions and permits remote authenticated users to execute arbitrary code with root privileges.

Vulnerable mechanism: The vulnerability arises when cPanel passes unsanitized or insufficiently validated user-supplied input to an evaluation function that dynamically interprets and executes code at runtime. In the cPanel context, this involves authenticated user inputs from the web management interface being concatenated into strings destined for a dynamic code evaluation function. Because the input is evaluated as code rather than treated as inert data, a crafted request can inject additional code instructions that execute in the privileged context of the cPanel service.

Attack surface: The primary attack surface is the cPanel web administration interface, reachable over the network (typically ports 2082/2083 for cPanel user interfaces, and 2086/2087 for the WebHost Manager root interface). Since the vulnerability requires only a low-privilege authenticated session (CVSS PR:L), any standard cPanel account with the most minimal privileges — such as a domain owner, email account holder, or FTP-created sub-account — serves as the necessary foothold for exploitation. The only precondition is remote network access to the cPanel service and the ability to authenticate.

Technical specifics: The NVD description is sparse regarding the exact code path, function names, and file locations. Insufficient technical detail is available to identify the precise affected code module. However, the vuln class implies the presence of a dynamic eval-style sink within a cPanel backend script that processes arguments supplied by authenticated HTTP requests. Likely candidates include parameterized sub-commands requiring eval() for feature-specific processing, such as theme handling, addon domain management, or feature-based dynamic dispatch. Absent specific file paths, detection must rely on behavioral anomalies in process privileges and command construction.

Privilege escalation chain: The exploit culminates in executing arbitrary shell or Perl code in the context of the cPanel service process. Since cPanel daemons operate with root privileges — required to bind ports, traverse user file ownership, and handle system-level configuration — code injection directly yields root-level command execution without a separate escalation step.

Exploitation Scenarios

No public PoC is available; attack chain is inferred from vulnerability class.

Step 1 — Reconnaissance and target identification: The attacker identifies internet-facing cPanel instances running version 11.138.0.0 or earlier. Identification methods include Shodan queries (e.g., product:cPanel, http.title:"cPanel Login", http.html:"cPanel") and banner grabbing on ports 2082/2083. The attacker then obtains valid low-privilege credentials — through credential stuffing, password reuse from prior breaches, purchasing compromised accounts, or participating as a legitimate co-hosted tenant on the target server. No user interaction or network-level privileges are needed.

Step 2 — Triggering the flaw: Once authenticated to the cPanel web interface, the attacker crafts a special parameter within an HTTP request destined for a feature that passes input into the dynamic code evaluation sink. Knowing the vuln stem from CWE-95, the attacker expects that certain request parameters are embedded directly into an evaluation context without adequate encoding or allow-listing. Malicious input would typically embed payload delimiters and escape sequences designed to terminate the intended code string and inject arbitrary instructions. Low account privileges suffice because the vulnerable code path does not enforce additional authorization.

Step 3 — Payload execution: The injected payload executes within the evaluation engine, resulting in arbitrary command execution as the cPanel service account, which is root. Payloads at the vuln class level commonly: create a reverse shell to attacker infrastructure; write SSH keys into root/.ssh/authorized_keys; create new root-equivalent system accounts; install persistent backdoors (e.g., web shells, modified utilities); or modify cron jobs for scheduled re-entry. Because the eval context runs with root, all such actions complete without privilege boundary crossing.

Step 4 — Post-exploitation impact: With root access on a hosting server, the attacker achieves complete administrative takeover. Potential next actions include: reading all hosted virtual-host credentials, databases, and customer data; manipulating DNS zone files; reconfiguring mail services to exfiltrate email; defacing all hosted websites; using the compromised server for phishing campaigns or cryptocurrency mining; and most critically, compromising adjacent servers via trusted administrative access. The compromise cascades to every tenant on that server, expanding the incident scope beyond the single cPanel account.

Impact Assessment

The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — score 8.8) communicates high and immediate severity. With network attack vector and low attack complexity, the vulnerability is remotely exploitable without special conditions. The requirement of low privileges (PR:L) reduces only marginal exploit difficulty, as standard hosting accounts are trivially obtained. Scope remains unchanged (S:U), meaning the vuln only affects the target server components, but the absolute impact within that scope is the maximum: complete confidentiality loss (C:H), complete integrity loss (I:H), and complete availability loss (A:H).

Business impact: Full root-level compromise of a shared hosting infrastructure exerts cascading effects: customer data breaches (all tenants’ databases, credentials, personal data), regulatory penalties for data mishandling, reputational damage, and operating disruption if attackers destroy server functionality. For larger organizations running cPanel as a managed hosting offering, monetary exposure can be substantial through breach notification, forensic costs, downtime, and customer churn. The 8.8 CVSS score reflects a top-tier priority ranking; the EPSS score (0.00642, 48.4th percentile) suggests modest immediate exploit activity, but does not negate the need for rapid remediation — hosting platforms are attractive targets for persistent attackers who inventory and exploit these instances as opportunities arise.

Blast radius: On a single multi-tenant server, the successful exploit exposes all virtual host partitions, mail queues, DNS records, and database content to full compromise. Lateral movement to adjacent servers frequently follows since hosting admins often share root credentials or automation keys across the fleet.

Detection Guidance

Sigma Rule

title: cPanel Eval Injection - Suspicious Execution from cPanel Daemons
id: 0b102f8e-2c9a-4ab4-9c2c-2a41d5e6e18f
status: experimental
description: Detects anomalous child process creation from cPanel daemons indicating eval injection (CVE-2026-65643) leading to arbitrary command execution
author: Valtersit Threat Intel
date: 2026-01-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-65643
logsource:
    category: process_creation
    product: linux
detection:
    selection_parent:
        ParentImage|contains:
            - '/usr/local/cpanel/'
            - 'cpanel'
    selection_shell:
        Image|endswith:
            - '/bin/sh'
            - '/bin/bash'
            - '/bin/dash'
            - '/usr/bin/perl'
            - '/usr/bin/python'
    selection_recon:
        CommandLine|contains:
            - 'whoami'
            - 'id'
            - 'uname -a'
            - 'cat /etc/shadow'
            - 'curl'
            - 'wget'
            - 'nc '
            - '/dev/tcp'
    filter_normal:
        ParentImage|endswith:
            - '/cpaneld'
            - '/whm'
    condition: selection_parent and selection_shell and selection_recon and not filter_normal
level: high
falsepositives:
    - Legitimate cPanel maintenance scripts invoking shells for system tasks
    - CentOS/CSM plugins performing package updates
tags:
    - attack.privilege_escalation
    - attack.t1068
    - cve.2026.65643
    - cwe.95

YARA Rule

rule cpanel_eval_injection_cve_2026_65643 {
    meta:
        author = "Valtersit Threat Intel"
        date = "2026-01-10"
        description = "Detects suspicious eval() sink usage patterns in cPanel backend scripts 
                       that may indicate eval injection payloads (CVE-2026-65643)"
        references = "https://nvd.nist.gov/vuln/detail/CVE-2026-65643"
        cve = "CVE-2026-65643"
        severity = "high"
    strings:
        // Common eval wrapper calls in Perl context
        $eval_perl = /eval\s*\(\s*"\$[A-Za-z_]/
        $eval_dollar = /eval\s*\(\s*\$/
        // HTTP parameter names frequently passed to eval sinks
        $param_q = /param\s*\(\s*["'](?:action|cmd|command|op|task)["']\s*\)/
        $cgi_q = /\$q->param\s*\(\s*["'](?:action|cmd|command)["']\s*\)/
        // Direct shell command patterns indicative of exploitation
        $shell_rev = /sh\s+-c\s+.*(?:bash|sh)\s+-i/i
        $curl_down = /curl\s+\S+\s+[\-o\\\s]/i
        $wget_down = /wget\s+\S+\s+[\-O\\\s]/i
        $b64_decode = /\|base64\s*-\s*d/i
    condition:
        filesize < 5MB and 2 of ($eval_*) and 1 of ($param_*,$cgi_q) or
        filesize < 100KB and 1 of ($shell_rev,$curl_down,$wget_down,$b64_decode) and 1 of ($eval_perl,$eval_dollar)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-65643 - cPanel Eval Injection Attempt - Command Execution Indicators"; flow:to_server,established; content:"cpsess"; http.cookie; content:"POST"; http.method; content:"/cgi/"; http.uri; pcre:"/(?:action|cmd|command|op|task)=[^&]*?(?:system|exec|passthru|eval|`|\\$\()/iU"; pcre:"/(?:curl|wget|base64|nc\s+-e|/dev/tcp|python.* -c )/i"; sid:2026656431; rev:1; metadata:created_at 2026-01-10, cve CVE-2026-65643, cwe CWE-95, target_service http; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-65643; classtype:attempted-admin; priority:1;)

Elastic Detection

process where event.action == "exec" and process.parent.executable : "/usr/local/cpanel/*" and (
  process.args : ("-c", "-e") or
  process.name : ("sh", "bash", "dash", "perl", "python", "python3")
) and (
  process.command_line : ("*/dev/tcp/*", "*whoami*", "*uname -a*", "*/etc/shadow*", "*wget*", "*curl*", "*base64 -d*", "*-i >& /dev/tcp*")
)

Splunk SPL Query

index=linux sourcetype=linux_secure OR sourcetype=auditd
| search (process_name=sh OR process_name=bash OR process_name=dash OR process_name=perl OR process_name=python) AND (cwd="/usr/local/cpanel/*" OR parent_process=*cpanel*)
| search process_commandLine IN ("*whoami*", "*uname -a*", "*cat /etc/shadow*", "*wget*", "*curl*", "*/dev/tcp/*", "*base64 -d*", "*python -c*")
| table _time, host, user, process_name, process_commandLine, parent_process_name, cwd
| sort -_time
| stats values(process_commandLine) by host, parent_process_name

Wazuh OSSEC Rule

<group name="cpanel,">
  <rule id="656431" level="15">
    <decoded_as>syslog</decoded_as>
    <program_name>cpanel</program_name>
    <match>eval injection|exec failed|HUP nginx</match>
    <description>CVE-2026-65643 - Suspicious eval activity in cPanel logs indicating potential code injection attempt</description>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>

  <rule id="656432" level="15">
    <if_sid>656431</if_sid>
    <regex>system\(|exec\(|passwd|/bin/sh|whoami|/etc/shadow</regex>
    <description>CVE-2026-65643 - cPanel log shows command injection indicators from eval sink</description>
    <group>pci_dss_6.5,pci_dss_11.4,gdpr_IV_35.7.d,</group>
    <mitre>
      <id>T1068</id>
      <id>T1059.004</id>
    </mitre>
  </rule>

  <rule id="656433" level="12">
    <if_sid>656431</if_sid>
    <decoded_as>auditd</decoded_as>
    <match>exe="/bin/sh"</match>
    <description>CVE-2026-65643 - Audit log shows cPanel daemon spawning shell - possible eval injection</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED — single source (NVD) indicates a patch exists, but this has not been independently confirmed by MITRE or a vendor advisory. Treat this with caution: verify patching status through direct vendor contact before assuming remediation.

Immediate mitigations:

1. Restrict network exposure: Limit access to cPanel administrative interfaces (port 2082/2083, 2086/2087) to trusted internal IP ranges or VPN-accessible management networks only. Any external exposure of low-privilege account access multiplies exploitation opportunities.
2. Enforce MFA for all cPanel logins: Add an additional authentication layer to minimize the risk of credential compromise that would satisfy the PR:L requirement.
3. Monitor authentication logs: Enable detailed logging for cPanel account access and actively watch for anomalous login patterns (login farming, password reuse tests).
4. Apply least privilege to tenant accounts: Restrict what features each cPanel account can interact with; limit ability to create sub-accounts or addon domains if those features exercise the affected code path.
5. Watch for post-exploitation behaviors: Deploy the Sigma/YARA/Elastic/Splunk/Wazuh detection rules above on the cPanel server and centrally aggregate logs to detect immediate exploitation attempts.

Patch/Upgrade steps:

1. Since the vendor fix is marked as "N/A" in the CVE record and the patch confidence is only 2/4 (single-source claim), contact cPanel support directly to confirm availability of an official patch for CVE-2026-65643.
2. If a patch exists, upgrade cPanel to the latest version released after 11.138.0.0. Follow cPanel's official update procedures: access WHM → Home → cPanel Upgrade, or run /scripts/upcp --force from the root shell.
3. For systems already upgraded, verify the installed version is greater than 11.138.0.0 via cat /usr/local/cpanel/version.
4. If a patch is not yet available, escalate to the vendor for an emergency-release timeline; pursue any backported hotfix options.
5. Map affected installations by querying version across all managed servers and prioritize the upgrade schedule based on exposure (publicly accessible vs. internal management network).

Long-term hardening:

1. Maintain a strict upgrade cadence: keep cPanel version on the vendor's latest release path (controlled or edge), reviewing the release notes for security advisories before the next scheduled maintenance window.
2. Implement network-level segmentation so shared hosting servers reside in a dedicated DMZ zone isolated from corporate internal infrastructure.
3. Deploy a web application firewall (WAF) in front of cPanel interfaces capable of blocking dynamic code injection patterns, with periodic tuning against the latest signatures.
4. Implement centralized logging and full audit trail of authentication and process execution on all cPanel servers, with automated correlation across servers.
5. Enforce credential rotation policies for cPanel accounts, remove dormant accounts, and conduct quarterly access reviews for all tenant accounts.
6. Establish a server reimaging/redeployment process to guarantee a clean baseline should an unexploited backdoor be discovered after an incident.

References

1. NVD Entry — CVE-2026-65643: https://nvd.nist.gov/vuln/detail/CVE-2026-65643
2. CWE-95 — Improper Neutralization of Directives in Dynamically Evaluated Code: https://cwe.mitre.org/data/definitions/95.html
3. cPanel Security Advisories Portal: https://security.cpanel.net/ (vendor advisory not yet published for this CVE; check regularly)
4. cPanel Versioning & Update Documentation: https://docs.cpanel.net/installation/updating-cpanel/
5. ATT&CK Technique T1068 — Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/
6. CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-65643 is NOT listed — no known in-the-wild exploitation reported at time of writing)

No specific threat actor campaigns or independent exploit code linked to CVE-2026-65643 have been publicly disclosed as of this report date.