New cPanel Vulnerability Allows Attacker to Gain Full Control of the Server
cPanel disclosed critical SQL injection CVE-2026-67401 in EmailTrack, letting authenticated users with mail privileges gain root code execution; patched builds available.
cPanel disclosed CVE-2026-67401 on September 8, 2026, a critical SQL injection in the EmailTrack feature that monitors email delivery and routing. An authenticated attacker holding a valid cPanel account with mail-related privileges can create arbitrary files and achieve code execution as root, enabling full compromise of hosting servers and exposure of co-tenant customers. All supported cPanel/WHM versions before specific patched builds (11.110.0.143, 11.134.0.55, 11.136.0.39, 11.138.0.4 and 11.138.1.9 WP2) are affected; upgrading is the primary mitigation. No exploitation was reported at disclosure.
- Exploitation requires an authenticated cPanel account with mail privileges.
- Root access exposes hosted sites, databases, backups and stored credentials.
- Multi-tenant hosting means one compromise can affect other customers.
- Patched builds issued across 11.110, 11.134, 11.136 and 11.138 branches.
- Admins advised to review mail-privileged accounts and hunt for suspicious files.
- CVEs
- CVE-2026-67401
- Vendors
- cPanel
- Products
- cPanelWHMEmailTrack
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-67401 | Authenticated SQL Injection in cPanel EmailTrack Leads to Root RCE | 9.9 | <1% | PoC ×5 |
From the original article
2 min read at cybersecuritynews.com
cPanel has disclosed CVE-2026-67401, a critical SQL injection flaw in EmailTrack that could let authenticated attackers gain root-level control of vulnerable servers. cPanel disclosed the security issue on September 8, 2026. According to cPanel, an attacker must already possess a valid cPanel account with mail-related privileges to exploit the vulnerability.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.