cPanel has patched a flaw that lets a single hosting account take control of an entire server. An authenticated account holder with mail-related privileges can create files of their choosing on the server through EmailTrack and, from there, run code as the root user.
cPanel published the advisory on September 8 and says every supported version of cPanel and WHM is affected.
The flaw is tracked as CVE-2026-67401. cPanel’s advisory calls it an SQL injection issue in EmailTrack, but does not specify which cPanel feature or privilege level an account needs. cPanel’s developer documentation lists an EmailTrack module that tracks email statistics, and the advisory does not confirm whether that is the affected code.
cPanel is web hosting control panel software. A customer manages one hosting account via cPanel, while the provider manages the entire machine via WHM as the root user.
Attackers exploited a different cPanel flaw in April. Taking over the panel is not the same as breaking into one customer’s website, the security company Hadrian noted at the time, because WHM gives an attacker root administrative access to the server.
An attacker with that access can read every hosting account on the machine, change files and databases, create hidden accounts, install malware, steal credentials, and move into customer networks.
Fixed Builds
cPanel named the following fixed builds:
| Release Line | Fixed Build |
|---|---|
| 11.110 | 11.110.0.143 |
| 11.134 | 11.134.0.55 |
| 11.136 | 11.136.0.39 |
| 11.138 | 11.138.0.4 |
| WP Squared | 11.138.1.9 |
A server can be updated from WHM under Home / cPanel / Upgrade to Latest Version. On the command line, cPanel’s instructions are to log in as root and run /usr/local/cpanel/scripts/upcp --force.
Advisory Gaps
The advisory does not explain how an SQL injection problem leads to file creation and then to root access.
The advisory also offers no interim mitigation for servers that cannot update immediately. cPanel provided a workaround in its July 30 advisory for a database flaw, where administrators who could not upgrade were told they could temporarily remove the MySQL feature from cPanel users. No equivalent step appears in this advisory.
The patched list covers the 110, 134, 136, and 138 release lines. cPanel patched the 11.118 and 11.126 lines in its July advisories but has not listed them since, and has not said whether they remain supported. For the August flaw, the CVE record lists every version from 11.112.0.0 up to, but not including, 11.134.0.53 in the affected range and lists no fixed build in the 118 or 126 lines.
cPanel also does not say whether installing the patched build helps a server that was attacked before the update, or how an administrator would check.
Severity and Exploitation Status
The advisory carries no severity score. cPanel’s recent CVEs are assigned through HackerOne, and scores have been appearing in the CVE record rather than in the advisory. No CVE record for CVE-2026-67401 had been published when The Hacker News checked the CVE Program’s record store on September 9.
By comparison, the August flaw’s CVE record — published September 1, five days after that advisory — scores it 8.7 out of 10 on the CVSS scale, indicating high severity.
No public exploit code or report of exploitation appeared in searches conducted on September 9, and CVE-2026-67401 is absent from CISA’s Known Exploited Vulnerabilities catalog as of the version released on September 8. Neither check rules out exploitation. The April flaw — an authentication bypass requiring no account at all — is listed in that same catalog with documented use in ransomware campaigns.
Related cPanel Flaws
Two other cPanel flaws disclosed since late July also originate from an ordinary hosting account. The July 30 advisory covered a database flaw that could allow an account with database access to execute commands with full administrative privileges. An August 27 flaw in domain parking resulted in the same outcome as CVE-2026-67401: code execution as root. Repositories presenting themselves as working exploits for both of those flaws were online when The Hacker News checked on September 9.
cPanel credits Ali Mustafa (rz1027) and abed1526 with reporting CVE-2026-67401. The CVE record for the August flaw credits the same researcher, Ali Mustafa. Neither cPanel’s advisories nor that record ties the two flaws to the same code; they are classified differently — eval injection for the August flaw and SQL injection for this one.
