CVE-2026-65643: CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in WebPros cPanel

This vulnerability involves eval injection in cPanel, specifically in versions 11.112.0.0, 11.136.0.0, 11.138.0.0, and 11.138.1.0. Remote authenticated users can exploit this flaw to execute arbitrary code as root due to improper neutralization of directives in dynamically evaluated code (CWE-95). The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation has been published yet, and no known exploits are reported in the wild.

Successful exploitation allows remote authenticated users to execute arbitrary code with root privileges on affected cPanel installations, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability at a high level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict remote authenticated access to trusted users only and monitor for suspicious activity related to code execution attempts.