In a substantial security break, a vulnerability in cPanel’s EmailTrack module has been patched after it was found to allow hosting accounts with email privileges to execute arbitrary code as the root user. The flaw was addressed in a security advisory released on September 8, 2026. Every supported version of cPanel and WHM (WebHost Manager) was declared vulnerable. The issue has been tracked under CVE-2026-67401.
How the Flaw Works & What’s Affected
The problem stems from an SQL injection vulnerability in EmailTrack, a component that maintains email statistics. If an authenticated account has mail-related permissions, it can exploit this vector to create files on the server and eventually escalate privileges to gain root access through WHM. However, the advisory does not clarify exactly which subset of email privileges is necessary to carry out this attack.
cPanel is widely used in shared hosting environments: it gives account-level users control over individual sites and mailboxes, while WHM is used by server admins. Compromising cPanel’s EmailTrack therefore could let even non-admin users take full administrative control, accessing all sites, files, and credentials hosted on the machine.
Patch Status & What Administrators Need to Do
cPanel has already released patched builds for multiple release lines including 11.110 (fixed build 11.110.0.143), 11.134 (fixed in 11.134.0.55), 11.136 (11.136.0.39), 11.138 (11.138.0.4), and WP Squared edition 11.138.1.9. Servers still running any older version in those branches are at risk.
To update, administrators should use WHM’s “Upgrade to Latest Version” function, or run the command-line updater /usr/local/cpanel/scripts/upcp with the –force flag from a root shell.
The advisory does not explain how the SQL injection maps to file creation and the path to root execution, leaving some uncertainty about the precise attack chain. Also, there is no temporary mitigation suggested for admins who can’t immediately apply the patch.
Broader Context & Prior Incidents
This flaw adds to a series of privilege escalation vulnerabilities that have emerged in cPanel in recent months. In July, a mail‐database issue allowed a hosting user with database access to execute privileged commands. In late August, a domain parking bug similarly enabled privilege escalation to root.
No proof of public exploit or known attacks has been documented as of September 9, 2026. The CVE record had yet to publish a severity score or appear in the U.S. government’s Known Exploited Vulnerabilities list as of that date. Still, past incidents suggest that such flaws can rapidly be weaponized once disclosed.
Researchers Ali Mustafa (rz1027) and abed1526 are credited with discovering the vulnerability.
Administrative oversight regarding versions 11.118 and 11.126 was noted: cPanel had addressed them in earlier advisories, but the current advisory offers no clarity on whether those lines remain supported or if they’re affected now.
This flaw is critical not just for cPanel users but for any organization relying on shared hosting environments. Root-level compromise allows attackers to access customer data, deploy malware, or pivot into other parts of networks. The lack of guidance on interim mitigation increases risk until updates are applied. System admins should prioritize upgrades immediately and audit access rights on mail privileges. This shows once again how crucial carefully limiting rights—even for seemingly minor features—is in preventing severe escalation chains.
