cPanel EmailTrack SQLi to Root RCE (CVE-2026-67401)

On September 8, 2026, cPanel published a security advisory for CVE-2026-67401, a SQL injection vulnerability in its EmailTrack functionality.

The important part is not just the SQL injection label. According to cPanel, an authenticated cPanel account holder with mail-related privileges can create arbitrary files through EmailTrack. Successful exploitation can then lead to code execution as the root user — effectively giving an attacker full control of the server.

If you operate cPanel/WHM, particularly in a shared or multi-tenant environment, this is worth checking now rather than leaving it for the next maintenance window.

What cPanel confirmed

cPanel's advisory is short, but the impact it describes is serious.

The vulnerable functionality is EmailTrack. An attacker needs an authenticated cPanel account with mail-related privileges. From there, successful exploitation can allow arbitrary files to be created on the server.

The final impact is root-level code execution.

That distinction matters. This is not simply a vulnerability that lets someone read a database or modify an individual mailbox. cPanel explicitly says successful exploitation gives the attacker full control of the server.

cPanel credits Ali Mustafa (rz1027) and abed1526 for responsibly disclosing the vulnerability.

The vendor advisory does not provide a CVSS score, a detailed exploitation procedure, a public proof of concept, or a vendor-specific indicator of compromise.

Those omissions are important because they define what we can — and cannot — responsibly say about the vulnerability today.

What the CVE record adds

The CVE record was published on September 9, 2026, after the cPanel advisory (reserved July 29, 2026).

It describes CVE-2026-67401 as allowing a mail-enabled account to achieve remote code execution as root through SQL injection in the EmailTrack component.

The record classifies the vulnerability as CWE-89 (SQL Injection) and assigns a CVSS v3.0 score of 9.9 (Critical).

The vector is:

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

In practical terms, the score describes a network-accessible vulnerability with low attack complexity and low privileges required. It requires no user interaction, and the assessed impact covers confidentiality, integrity and availability.

There is an important provenance detail here:

The 9.9 CVSS score comes from the CVE record, not from cPanel's advisory.

That distinction is easy to lose when security articles combine vendor advisories and CVE databases into one paragraph. For this vulnerability, the vendor's advisory establishes the technical impact; the CVE record adds its own standardized classification and scoring.

Which cPanel versions are affected?

cPanel states that all supported versions are affected.

The patched builds listed in the advisory are:

11.110.0.143
11.134.0.55
11.136.0.39
11.138.0.4
WP2: 11.138.1.9

The safest approach is not to rely on the branch name alone. Check the actual version installed on the server.

From the shell:

cat /usr/local/cpanel/version

You can also check the version through WHM's Server Information page.

If your installed build is below the patched build for its branch, update cPanel/WHM using the vendor's supported update procedure.

Do not manually interpret the version list as a generic "upgrade to the newest major version" requirement. The important comparison is whether the installed branch/build has reached the patched level identified by cPanel.

Why this matters for shared hosting

The biggest concern is the privilege boundary.

In a typical shared hosting environment, an individual customer account should be isolated from the host operating system and from other customers.

The advisory describes a path from an authenticated account with mail-related privileges to arbitrary file creation, followed by root code execution.

Conceptually:

Authenticated account
        ↓
Mail-related privileges
        ↓
EmailTrack SQL injection
        ↓
Arbitrary file creation
        ↓
Root code execution
        ↓
Full server control

That last step is not an inference from the CVSS score. It comes directly from cPanel's impact statement.

For a single-user server, root-level compromise is already serious.

For a shared hosting server, the blast radius can be much larger because the same operating-system instance may host multiple customers, applications, mailboxes and administrative services.

The exact post-compromise consequences depend on how that server is configured. The vulnerability itself should therefore not be used as evidence that a particular customer's data was accessed or that a particular service was compromised.

What should administrators do?

The first action is straightforward: check the installed build and patch it.

A sensible response sequence is:

1. Check the installed cPanel/WHM version.
2. Compare it with the patched build for the relevant branch.
3. Update to the vendor's patched version.
4. Verify that cPanel/WHM and hosted services remain healthy after the update.
5. If the server was exposed while running a vulnerable build, consider whether additional investigation is warranted.

The fifth step is important.

Patching fixes the vulnerability. It does not prove that the server was never compromised before it was patched.

At the time of writing, cPanel's advisory does not provide a vendor-specific indicator-of-compromise checklist for this vulnerability. That means administrators should avoid pretending there is a definitive forensic test when the vendor has not published one.

If the server was particularly sensitive, heavily exposed, or showed suspicious activity while vulnerable, a proper incident-response investigation may be appropriate.

Is it being exploited?

This is where security reporting needs a little restraint.

As of September 9, 2026, the evidence checked for this article does not establish active exploitation of CVE-2026-67401.

The CVE record's CISA SSVC information lists exploitation as none, and the vulnerability was not present in the CISA Known Exploited Vulnerabilities catalog when checked.

Independent reporting also did not identify a public exploit or confirmed exploitation at the time this article was checked.

That does not mean the vulnerability is safe to ignore.

A newly disclosed remote-code-execution path in a widely used hosting platform can become much more interesting to attackers once technical details spread. The absence of confirmed exploitation is a statement about the evidence available at the time of checking, not a guarantee about what happens next.

For comparison, cPanel's April 2026 authentication-bypass vulnerability, CVE-2026-41940, is already present in CISA's KEV catalog. That historical example is relevant context, but it should not be interpreted as evidence that CVE-2026-67401 is currently being exploited.

What we know — and what we don't

This distinction between confirmed, currently observed, and unknown is deliberate.

Security advisories often evolve after publication. A later PoC, exploitation report, vendor update or CISA listing could change some of these answers.

Bottom line

If you run cPanel/WHM, check your build.

The combination described by cPanel — an authenticated mail-enabled account, arbitrary file creation and eventual root code execution — makes this much more than a routine SQL injection patch.

The good news is that cPanel has already published patched builds.

The less comfortable part is that patching and investigation answer two different questions:

"Can attackers use this vulnerability now?" is addressed by patching.

"Did somebody already use it before we patched?" is a separate question.

For servers that were running an affected build, especially multi-tenant systems, it is worth treating those as two separate tasks.

Sources

• cPanel security advisory — primary vendor source
• CVE-2026-67401 — CVE record and scoring
• The Hacker News — secondary reporting and disclosure context