cPanel disclosed CVE-2026-67401 on September 8, scoring it 9.9 out of 10. The bug sits in EmailTrack, the built-in feature that logs and displays email delivery and routing activity for cPanel accounts. An account holder with nothing more than ordinary mail privileges — the kind granted by default to most shared-hosting customers — can turn that logging feature into a root shell.
The Bug
EmailTrack builds SQL queries from data tied to mail delivery events without adequately sanitizing it. An authenticated user with mail privileges can inject SQL through this path and abuse it to write a file of their choosing to an arbitrary location on the filesystem. Because parts of the mail and cron subsystem on a cPanel server run as root, an attacker who can plant a file in the right place — a cron entry, a script referenced by a root-run process, a config file consumed by a privileged service — gets code execution as root from there.
The net effect: a customer on a shared-hosting box with a $5/month mail-enabled account can escalate straight to full root on the underlying server. There’s no cross-account trickery or kernel exploit involved — the SQLi-to-file-write-to-RCE chain does all the work by itself.
This is the same broad failure pattern seen in this year’s other cPanel advisories (CVE-2026-41940’s auth bypass, the CVE-2026-29201/29202/29203 TSR storm): a feature meant for a narrow, low-privilege purpose ends up with a trust boundary that doesn’t hold, and the panel’s root-owned service architecture turns any breach of that boundary into full compromise.
Affected Versions
Every currently supported cPanel & WHM release line was vulnerable prior to these builds:
- 11.110.0.143
- 11.134.0.55
- 11.136.0.39
- 11.138.0.4
- 11.138.1.9
There is no version of the supported product that was unaffected — this is a core EmailTrack code path present across every release track. If you’re running an unsupported branch, there is no backport; upgrade to a supported track or take the panel out of service.
Who’s Affected
The attack surface is bounded by “requires a valid account with mail privileges,” which sounds like it limits exposure to insiders — but on shared hosting and reseller infrastructure, that describes the overwhelming majority of paying customers. Any hosting provider, reseller, or managed-server operator running a vulnerable cPanel/WHM build has an entire customer base that can, individually, escalate to root on the box they share with everyone else on that server. Multi-tenant environments are the worst case: one malicious or compromised customer account becomes root access to every other tenant’s mail, databases, and files on the same physical or virtual host.
No public proof-of-concept or evidence of in-the-wild exploitation had surfaced as of this writing, and the CVE was not yet present in CISA’s Known Exploited Vulnerabilities catalog. That’s a narrow window, not a reprieve — SQLi-to-root chains in widely deployed panel software have historically had working exploits within days of disclosure, and cPanel’s footprint across the hosting industry makes this a high-value target to reverse from the patch diff.
Mitigation
Patch immediately. Run /scripts/upcp --force to pull the latest build for your release track and confirm the version with /usr/local/cpanel/cpanel -V afterward — cross-check it against the fixed builds listed above, not just “newer than what I had.”
Until patched, providers running multi-tenant boxes should treat every mail-privileged account as a potential root-equivalent actor. Review recent EmailTrack activity and cron changes for anything anomalous, audit for unexpected files dropped outside normal customer document roots, and check /var/cpanel/version plus WHM’s update log to confirm which hosts in your fleet are still exposed. If a mail account behaved oddly around the disclosure window (September 8 onward) and the host wasn’t yet patched, treat that server as a root-compromise candidate rather than assuming the account-level anomaly was contained.