cPanel has disclosed a critical SQL injection vulnerability in its EmailTrack functionality that could allow a low-privileged, authenticated account to execute code as root.
Tracked as CVE-2026-67401, the flaw affects all supported cPanel & WHM releases and requires immediate patching.
According to cPanel’s September 8 security advisory, exploitation begins with an authenticated cPanel account that has mail-related privileges.
cPanel EmailTrack SQL Injection Flaw
The vendor said attackers can abuse this access through EmailTrack to create arbitrary files on the underlying server. The result is code execution as the root user, giving an attacker complete control of the host.
The advisory describes the bug as SQL injection, but does not publish technical exploitation details, proof-of-concept code, affected request parameters, or a CVSS score.
That restraint matters: defenders should avoid assuming that the absence of public exploit code means exposure is low.
On shared hosting infrastructure, a compromised customer-level account with suitable mail permissions could become a route from a tenant context to the server’s most privileged account.
Root-level execution would let an intruder alter hosted content, implant persistence, access credentials and configuration data, manipulate mail services, and pivot into other accounts or connected systems.
cPanel stated that the arbitrary-file creation condition is particularly serious because file writes can be combined with server-side execution paths or modified configuration to turn initial access into a full system compromise.
Administrators should treat the flaw as a server-integrity issue rather than solely a web-panel vulnerability.
All supported cPanel/WHM versions are affected. cPanel has released fixed builds across its maintained release trains: version 11.110.0.143, 11.134.0.55, 11.136.0.39, and 11.138.0.4.
The vendor also issued WP2 version 11.138.1.9. Systems should be upgraded to the applicable patched build or a newer release without delay.
Before updating, operators should inventory every cPanel/WHM server, identify its installed release and update tier, and ensure maintenance windows do not leave less-visible fleet members behind.
After the upgrade, teams should verify the installed build number, review update logs, and confirm that normal panel and mail workflows remain functional.
Because exploitation requires authentication and mail-related privileges, organizations should also audit cPanel accounts, remove stale users, apply least privilege to mail features, and investigate unexpected account activity.
Useful review points include newly created or modified files in sensitive web and system paths, unfamiliar scheduled tasks, suspicious changes to panel or web-server configuration, unusual outbound connections, and root-level processes with no approved change record.
The disclosure illustrates a recurring hosting-security concern: management-plane weaknesses can turn a single valid tenant credential into a threat to the entire server.
Rapid patch deployment, access hygiene, and post-update validation are the practical priorities for reducing exposure to CVE-2026-67401.
Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC
