Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root. (CVE-2026-65643)

CVE-2026-65643 is an eval injection vulnerability in cPanel 11.138.0.0 and earlier versions. It allows remote authenticated users to execute arbitrary code as root by exploiting improper handling of input that is evaluated dynamically. The vulnerability is classified under CWE-95 (Improper Control of Generation of Code). The CVSS v3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, requiring privileges but no user interaction, and impacts confidentiality, integrity, and availability at a high level.

Successful exploitation allows remote authenticated users to execute arbitrary code with root privileges on the affected system, potentially leading to full system compromise including data theft, system manipulation, or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's security advisories for updates. In the meantime, restrict access to authenticated users and consider additional access controls to limit exposure.