cPanel has disclosed a serious vulnerability—CVE-2026-67401—in its EmailTrack component that permits authenticated users to achieve root-level control on compromised servers. The flaw, revealed on September 8, 2026, stems from an SQL injection issue that enables threat actors with email permissions to write arbitrary files and execute code as the system’s superuser. While full remote exploitation requires a valid cPanel account with mail-related rights, the risk is especially high for shared hosting and environments with multiple users.
What’s at Stake
EmailTrack is used by cPanel to log and examine details about email delivery, including routing and delivery status. The vulnerability allows an attacker who already has a mail-privileged account to exploit that system, create files on the underlying server, and escalate access all the way to root.
A root-level compromise could lead to unauthorized access across hosted websites, databases, email accounts, stored credentials, backup and configuration files. An attacker could establish persistence, manipulate or alter content, disable security measures, exfiltrate data, or use the compromised host to launch other attacks.
Affected Versions and Mitigation Steps
The vulnerability, discovered by security researcher Ali Mustafa, impacts all supported versions of cPanel/WHM until specific patched builds. The versions fixed include:
- cPanel & WHM 11.110 → 11.110.0.143
- cPanel & WHM 11.134 → 11.134.0.55
- cPanel & WHM 11.136 → 11.136.0.39
- cPanel & WHM 11.138 → 11.138.0.4
- WP2 release → 11.138.1.9
Administrators are urged to check whether their systems are running any of the vulnerable releases and to upgrade immediately to one of the patched versions. For those relying on managed hosting, it’s critical to verify that their provider has pushed the updates.
Besides patching, administrators should audit accounts with email-related permissions, remove any that aren’t necessary, and enable strong authentication controls like multi-factor authentication (MFA). Monitoring for suspicious files, unexpected changes in directories or configurations, unusual root processes, and anomalous outbound connections is essential. Reviewing logs tied to cPanel, the web server, system, and authentication services will help detect post-exploitation activity.
The scope of this vulnerability isn’t limited to a single server: in multi-tenant setups, one compromised privileged account could endanger multiple clients sharing the same infrastructure. Even though attackers need authentication, the damage possible once inside is extensive.
This SQL injection flaw in EmailTrack underscores how even narrow-seeming privileges in admin panels can become devastating when chained with vulnerabilities. It’s a reminder that patching, least privilege, and continuous monitoring remain vital elements of server security. System administrators should treat this issue with urgency and ensure all exposed versions are updated as soon as possible.
