cPanel has patched CVE-2026-67401, a flaw that let a mail-privileged cPanel account reach root on the server it sits on. In the advisory’s own words, an authenticated cPanel account holder with mail-related privileges could “create arbitrary files on the server through cPanel’s EmailTrack functionality,” and successful exploitation “leads to code execution as the root user, giving an attacker full control of the server.” The advisory went out on September 8. It lists all supported versions of cPanel and WHM as affected.
That combination is what makes this one worth acting on quickly. A shared server exists to keep unrelated customers apart, and root is the level at which that separation stops meaning anything. The account needed to start is not an administrator’s.
Key facts
- What it is: an authenticated account with mail-related privileges could create files through EmailTrack and, the advisory says, reach code execution as root. All supported versions of cPanel and WHM were affected.
- The fix: five patched builds, listed in the table below.
- Critical, no interim mitigation: the cPanel advisory carries no severity rating and offers no temporary measure. The CVE record published on September 9 scores the flaw 9.9 out of 10, critical.
- Exploitation: The Hacker News found no public exploit code and no report of exploitation on September 9, and the flaw was absent from CISA’s known exploited vulnerabilities catalog as published on September 8. Neither finding rules out exploitation.
One Account, Then the Whole Machine
The structure of the problem matters more than its label. cPanel is what a customer uses to manage an individual hosting account. WHM is the administrative layer providers use to manage the server. A flaw that takes someone from a cPanel account to root-level code execution on the host removes the isolation boundary the shared-hosting model depends on, which is why an issue that begins inside one email feature ends up being a server-level event.
The advisory keeps its description short. It names EmailTrack as the route and mail-related privileges as the requirement, without identifying which privilege or feature an account actually needs. For a provider working out how exposed it is, that is the practical gap.
The Builds That Carry the Fix
cPanel published five patched builds. There is one for each affected release line and one for WP Squared. For the procedure, the advisory points to the company’s own update documentation.
| Release line | Fixed build |
|---|---|
| 11.110 | 11.110.0.143 |
| 11.134 | 11.134.0.55 |
| 11.136 | 11.136.0.39 |
| 11.138 | 11.138.0.4 |
| WP Squared | 11.138.1.9 |
Two things follow from that for anyone running a fleet. Servers held back on an older line need checking against the specific build number rather than against a general sense of being current, because the fix is expressed as a build within each line rather than as one version to move to. And because the advisory offers no temporary measure, patching is the only step it puts forward.
The Score Arrived a Day Later, at 9.9
The cPanel advisory carries no severity rating of its own. That gap closed on September 9, when the record for CVE-2026-67401 was published and scored the flaw 9.9 out of 10, critical. The Hacker News noted that cPanel’s recent CVEs are assigned through HackerOne, with their scores appearing in the CVE records rather than in the company’s advisories.
The vector behind the number says as much as the number. It records low privileges as enough to begin and a change of scope, consistent with an attack that starts from a limited account and ends in root-level execution.
The record summarizes the issue in one line, a mail-enabled account reaching remote code execution as root through SQL injection in EmailTrack, classified as CWE-89. What neither document sets out is how the SQL injection results in arbitrary file creation and ultimately root execution. The advisory offers no guidance for working out whether a server was compromised before it was patched.
cPanel credits Ali Mustafa, working as rz1027, and abed1526 with reporting the flaw.
About the Data
The description of the flaw, the affected range, the patched build numbers, the instruction to update and the credit to the researchers come from cPanel’s advisory for CVE-2026-67401, published September 8 and read on September 9. The absence of a severity rating and of any interim mitigation is our own reading of that advisory. The score, the scoring vector and the one-line description of the chain come from the CVE record for the same flaw, published later on September 9. The checks on exploit code, exploitation reports and the catalog of known exploited vulnerabilities are attributed to The Hacker News and dated to its own reporting that day.
