WebPros security advisory (AV26-908)
Canada's Cyber Centre relays WebPros advisories for SQL injection (CVE-2026-67401) in cPanel and two ConfigServer Firewall flaws.
The Canadian Centre for Cyber Security published advisory AV26-908 covering vulnerabilities in WebPros products, including cPanel & WHM and ConfigServer Security & Firewall (CSF). Affected cPanel builds include versions prior to 11.110.0.143, 11.134.0.55, 11.136.0.39, 11.138.0.4 and WP2 11.138.1.9, while CSF versions 14.00-16.29 (CVE-2026-65638) and 2.15-16.29 (CVE-2026-65639) are also affected. CVE-2026-67401 describes SQL injection in cPanel's EmailTrack functionality. Users and administrators are encouraged to review the advisories and apply available updates.
- CVE-2026-67401 is a SQL injection in cPanel's EmailTrack functionality.
- CVE-2026-65638 affects ConfigServer Security & Firewall versions 14.00 to 16.29.
- CVE-2026-65639 affects ConfigServer Security & Firewall versions 2.15 to 16.29.
- Multiple cPanel & WHM release lines require updating to patched builds.
- Advisory AV26-908 was published September 10, 2026 by the Canadian Cyber Centre.
- Organizations
- Canadian Centre for Cyber Security
- Countries
- Canada
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-65639+1 related CVE | OS Command Injection in ConfigServer Security & Firewall (CSF) Allows Root RCE | 9.5 group max | — | ||
| CVE-2026-67401 | Authenticated SQL Injection in cPanel EmailTrack Leads to Root RCE | 9.9 | <1% | PoC ×5 |
From the original article
1 min read at cyber.gc.ca
Serial number: AV26-908 Date: September 10, 2026 As of September 10, 2026, WebPros is affected by vulnerabilities in the following products: cPanel & WebHost Manager (WHM) software Prior to 11. 110. 0.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.