Full Report
WebPros security advisory (AV26-908)
Analysis Summary
# Vulnerability: Multiple Vulnerabilities in WebPros cPanel, WHM, and CSF
## CVE Details
- **CVE ID:** CVE-2026-67401, CVE-2026-65638, CVE-2026-65639
- **CVSS Score:** Not explicitly listed (Estimated High based on SQL Injection and Security Release status)
- **CWE:** CWE-89 (SQL Injection) for CVE-2026-67401; Others not specified.
## Affected Systems
- **Products:**
- cPanel & WebHost Manager (WHM)
- ConfigServer Security & Firewall (CSF)
- **Versions:**
- **cPanel/WHM:** Prior to 11.110.0.143, 11.134.0.55, 11.136.0.39, 11.138.0.4, and 11.138.1.9 (WP2).
- **CSF (CVE-2026-65638):** Versions 14.00 to 16.29.
- **CSF (CVE-2026-65639):** Versions 2.15 to 16.29.
- **Configurations:** Systems utilizing the EmailTrack functionality in cPanel are specifically at risk for CVE-2026-67401.
## Vulnerability Description
The advisory covers three primary flaws:
1. **CVE-2026-67401:** A SQL Injection vulnerability residing in the `EmailTrack` functionality of cPanel. This allow an attacker to interfere with the queries that an application makes to its database, potentially leading to unauthorized data access or modification.
2. **CVE-2026-65638 & CVE-2026-65639:** Security vulnerabilities within the ConfigServer Security & Firewall (CSF) software. While technical specifics (e.g., Buffer Overflow vs. Logic Flaw) are not detailed in the brief, they are designated as critical security releases for the firewall component.
## Exploitation
- **Status:** Not exploited (No reports of active exploitation in the wild at this time).
- **Complexity:** Medium (SQLi typically requires knowledge of the database schema).
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** High (Potential database exfiltration via SQLi).
- **Integrity:** High (Potential unauthorized modification of data or firewall rules).
- **Availability:** Medium (Potential for service disruption via database manipulation).
## Remediation
### Patches
WebPros has released the following patched versions. Administrators should update immediately:
- **cPanel & WHM:**
- 11.110.0.143
- 11.134.0.55
- 11.136.0.39
- 11.138.0.4
- 11.138.1.9 (WP2)
- **CSF:** Update to versions beyond 16.29.
### Workarounds
- No specific workarounds provided. Disabling the `EmailTrack` feature may reduce the attack surface for CVE-2026-67401, but patching is the recommended course of action.
## Detection
- **Indicators of Compromise:** Unusual SQL syntax in cPanel logs, specifically targeting email tracking modules. Unauthorized changes to CSF firewall configurations.
- **Detection methods and tools:** Audit database logs for `EmailTrack` queries containing unexpected characters (quotes, semicolons, or UNION statements).
## References
- **cPanel EmailTrack Advisory:** hxxps[://]support[.]cpanel[.]net/hc/en-us/articles/43187903921559-Security-CVE-2026-67401-SQL-Injection-Vulnerability-in-cPanel-s-EmailTrack-Functionality-September-8-2026
- **CSF Security Release (65638):** hxxps[://]support[.]cpanel[.]net/hc/en-us/articles/43387915588375-Security-CVE-2026-65638-CSF-Security-Release
- **CSF Security Release (65639):** hxxps[://]support[.]cpanel[.]net/hc/en-us/articles/43387923160343-Security-CVE-2026-65639-CSF-Security-Release
- **Cyber Centre Advisory:** hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/webpros-security-advisory-av26-908