cPanel Patches EmailTrack SQL Injection Allowing Root Code Execution (CVE-2026-67401); ConfigServer Firewall Flaws Also Flagged

CVE-2026-65638 is an unauthenticated shell command injection flaw (CWE-78) in ConfigServer Security & Firewall (CSF), caused by improper escaping of a request URL. An attacker who sends a crafted request URL containing shell metacharacters to the affected web-facing component can have arbitrary commands executed under the CSF service account. Successful exploitation therefore yields command execution on the server in the context of the CSF service account, with a critical CVSS 4.0 score of 9.2 reflecting high confidentiality, integrity, and availability impact on the vulnerable system. The flaw affects versions originally distributed by ConfigServer as well as versions of the WebPros-maintained fork that contain the vulnerable code; WebPros has fixed it in version 16.30, and other independently maintained CSF forks should be evaluated separately. There is no public proof of concept, the issue is not in CISA's Known Exploited Vulnerabilities catalog, and no exploitation has been reported to date.

Do: Upgrade the WebPros-maintained CSF fork to version 16.30 or later and verify which fork and version your deployment actually uses. If you run the original ConfigServer distribution or a third-party fork, monitor the respective maintainer for a patched release and assess your version independently. Until patched, restrict unauthenticated access to the CSF web interface (e.g., limit it to trusted management networks or localhost/VPN) and watch for unexpected command execution by the CSF service account.

CVE-2026-65639 is an OS command injection flaw (CWE-78, CVSS 4.0 score 9.5, critical) in the advanced-rule parser of ConfigServer Security & Firewall (CSF), a widely used Linux firewall suite. It is triggered when the parser processes rule data supplied by a configured allow/deny feed: because feed-supplied rule content is not sufficiently validated, an attacker who can control the contents of such a feed (for example by controlling or tampering with the feed source) can inject and execute arbitrary shell commands. Injected commands run as root, so successful exploitation yields full takeover of the host, with high impact to confidentiality, integrity, and availability (the CVSS AT:P metric reflects the precondition that a feed must be configured and attacker-influenced). Affected deployments include versions originally distributed by ConfigServer and versions of the WebPros-maintained fork that contain the vulnerable code; WebPros has fixed the issue in version 16.30, while other independently maintained forks may also be affected. No public proof-of-concept is known, the flaw is not in CISA KEV, and there is no confirmed exploitation in the wild at this time.

Do: Upgrade the WebPros-maintained CSF to version 16.30 or later. Operators running ConfigServer-distributed builds or third-party forks should confirm with their maintainer whether a fixed release exists, and in the meantime audit all configured allow/deny feeds - restrict feed sources to trusted HTTPS URLs under your control and treat feed content as untrusted input. Because injected commands run as root, prioritize patching internet-facing servers first.

CVE-2026-67401 is a critical SQL injection (CWE-89) in the EmailTrack component of cPanel, the widely used hosting control panel. An attacker holding any mail-enabled account on the server can reach the vulnerable component over the network with low privileges and no user interaction (CVSS: AV:N/AC:L/PR:L/UI:N), and the injection crosses a privilege boundary (Scope: Changed) to achieve remote code execution as root. Successful exploitation yields full compromise of the host — arbitrary commands as root with complete access to all hosted data — so every site, mailbox and account on an affected server is exposed. All cPanel deployments with mail enabled are potentially affected; the available data does not specify exact vulnerable version ranges, which are provided in WebPros security advisory AV26-908. Exploitation has not been confirmed in the wild (not in CISA KEV), but two public proof-of-concept exploits are already on GitHub, making near-term exploitation likely.

Do: Upgrade cPanel to the patched release identified in WebPros advisory AV26-908 (exact fixed version numbers are not given in the available data), prioritizing internet-facing servers that host mail-enabled accounts. Until patched, restrict access to the EmailTrack component and audit mail-enabled accounts and logs for suspicious database queries or unexpected root-level processes, since public PoC exploits are already available.