← All advisories

Critical severity9.9NVD Advisory· Published Sep 9, 2026· Updated Sep 10, 2026

CVE-2026-67401

CVE-2026-67401

Description

A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component

Affected products

2

CPanel/EmailTrackllm-fuzzy
CPanel/Cpanelllm-fuzzy

Patches

Vulnerability mechanics

References

1

support.cpanel.net/hc/en-us/articles/43187903921559-Security-CVE-2026-67401-SQL-Injection-Vulnerability-in-cPanel-s-EmailTrack-Functionality-September-8-2026nvd

News mentions

4

New Cpanel Vulnerability Allows Attackers to Access Other Users’ Accounts
Cyber Security News · Sep 23, 2026
⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits
The Hacker News · Sep 14, 2026
New cPanel Vulnerability Allows Attacker to Gain Full Control of the Server
Cyber Security News · Sep 9, 2026
New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root
The Hacker News · Sep 9, 2026