Critical cPanel Vulnerability Allows Root-Level Server Control via SQL Injection
A critical SQL injection vulnerability (CVE-2026-67401) in cPanel's EmailTrack functionality allows authenticated attackers to gain root-level control of servers, enabling arbitrary file creation and code execution.
cPanel has disclosed CVE-2026-67401, a critical SQL injection flaw in its EmailTrack functionality that could allow authenticated attackers with mail privileges to gain root-level control of vulnerable servers. The security issue was disclosed by cPanel on September 8, 2026, and while exploitation requires a valid cPanel account with mail-related privileges, the potential impact remains severe for shared hosting providers, managed servers, and organizations with multiple cPanel users.
The vulnerability resides within cPanel's EmailTrack feature, which is designed to monitor and review email delivery activity, including message routing and delivery information. A malicious authenticated user can abuse this functionality to create arbitrary files on the underlying server. This capability is particularly dangerous in a hosting environment, as it can allow attackers to place controlled content in sensitive system locations.
Successful exploitation of CVE-2026-67401 can lead to code execution with root privileges. Root access grants unrestricted control over the operating system, enabling attackers to access hosted websites, databases, email accounts, backups, configuration files, and credentials stored on the server. With root-level access, attackers can install persistence mechanisms, deploy malware, alter website content, steal customer data, disable security tools, or utilize the compromised server to launch further attacks.
In multi-tenant hosting environments, the compromise of a single privileged cPanel account could place other customers hosted on the same server at significant risk. The vulnerability was reported by security researcher Ali Mustafa, also known as (nd abe)1526. It affects all supported cPanel/WHM versions prior to specific patched releases.
cPanel/WHM versions affected and their respective patched versions include: cPanel & WHM 11.110 (prior to 11.110.0.143), cPanel & WHM 11.134 (prior to 11.134.0.55), cPanel & WHM 11.136 (prior to 11.136.0.39), and cPanel & WHM 11.138 (prior to 11.138.1.9, also known as WP2 release).
Server administrators are urged to verify their installed cPanel/WHM version immediately and upgrade to a patched release. Organizations utilizing managed hosting should also confirm with their providers that the necessary updates have been applied across all affected systems. The primary mitigation is to update cPanel/WHM to the latest available patched version.
Administrators should not rely solely on restricting public access, as exploitation requires a legitimate authenticated account rather than anonymous access. Security teams should review cPanel accounts with email-related permissions and remove unnecessary privileges. Enabling strong passwords and multi-factor authentication for accounts is also recommended. Furthermore, administrators should investigate for suspicious files, unexpected changes to web directories, modified configuration files, unusual root-level processes, and unexplained outbound network connections. Reviewing cPanel, web-server, authentication, and system logs can aid in identifying exploitation attempts.