Full Report
cPanel has patched a flaw that it says lets a single hosting account take control of an entire server. An authenticated account holder with mail-related privileges can create files of their choosing on the server through EmailTrack and, from there, run code as the root user. cPanel published the advisory on September 8 and says every supported version of cPanel and WHM is affected.
Analysis Summary
# Vulnerability: cPanel EmailTrack Privilege Escalation to Root
## CVE Details
- **CVE ID:** CVE-2026-67401
- **CVSS Score:** Not yet assigned (Note: Similar recent flaws in cPanel have been rated **8.7 / High**)
- **CWE:** CWE-89 (SQL Injection)
## Affected Systems
- **Products:** cPanel & WHM, WP Squared
- **Versions:** All supported versions prior to the fixed builds listed below. Specifically affects release lines 11.110, 11.134, 11.136, and 11.138.
- **Configurations:** Systems where authenticated users have mail-related privileges.
## Vulnerability Description
The vulnerability is an SQL injection flaw residing in cPanel’s `EmailTrack` functionality (the module responsible for tracking email statistics). An authenticated hosting account holder with mail privileges can leverage this injection to perform unauthorized file creation on the server. Because of the way cPanel services interact with the underlying operating system, this arbitrary file creation allows the attacker to escalate privileges and execute code as the **root** user, effectively taking full control of the entire server.
## Exploitation
- **Status:** PoC not currently available; no confirmed exploitation in the wild for this specific CVE as of September 9, 2026.
- **Complexity:** Medium (Requires valid authenticated access with specific privileges).
- **Attack Vector:** Network (Authenticated).
## Impact
- **Confidentiality:** Total (Attacker can read all hosting accounts, databases, and files on the server).
- **Integrity:** Total (Attacker can modify system files, install malware, and create hidden accounts).
- **Availability:** Total (Attacker has root access to shut down or wipe the server).
## Remediation
### Patches
cPanel has released the following fixed builds. Administrators should update immediately:
- **cPanel/WHM 11.110:** Update to 11.110.0.143
- **cPanel/WHM 11.134:** Update to 11.134.0.55
- **cPanel/WHM 11.136:** Update to 11.136.0.39
- **cPanel/WHM 11.138:** Update to 11.138.0.4
- **WP Squared:** Update to 11.138.1.9
**Update via WHM:** Home / cPanel / Upgrade to Latest Version.
**Update via CLI:** Run `/usr/local/cpanel/scripts/upcp --force` as the root user.
### Workarounds
No specific workaround (such as disabling the EmailTrack feature) has been officially provided by the vendor. Immediate patching is the only recommended mitigation.
## Detection
- **Indicators of Compromise:** Unusual file creation in system directories or unauthorized modifications to mail-related configurations.
- **Detection methods:** Review cPanel access logs and SQL logs for suspicious queries targeting the `EmailTrack` module. Monitor for privilege escalation events where `cpanel` users execute commands typically reserved for `root`.
## References
- **Vendor Advisory:** hxxps[://]support[.]cpanel[.]net/hc/en-us/articles/43187903921559-Security-CVE-2026-67401-SQL-Injection-Vulnerability-in-cPanel-s-EmailTrack-Functionality-September-8-2026
- **General Instructions:** hxxps[://]support[.]cpanel[.]net/hc/en-us/articles/1500004959421-How-do-I-update-cPanel-WHM
- **News Source:** hxxps[://]thehackernews[.]com/2026/09/new-cpanel-flaw-lets-hosting-account.html