CVE-2026-67401 cPanel CVE debrief

Who should care

cPanel/WHM administrators and users with mail-related privileges should be aware of this vulnerability and take immediate action to protect their systems. Security teams responsible for monitoring and patching cPanel installations should verify exposure, review mail-related privileges, and update to patched versions to prevent potential server compromise. Additionally, security teams should monitor for suspicious activity related to EmailTrack and review c

Why it matters

CVE-2026-67401 is a SQL injection vulnerability in cPanel's EmailTrack functionality that allows authenticated account holders with mail-related privileges to create arbitrary files, potentially leading to code execution as the root user. cPanel administrators and security teams should verify exposure, review mail-related privileges, and update to patched versions to prevent potential server compromise.

• Potential code execution as root user, leading to full server compromise
• Elevation of privileges for authenticated account holders with mail-related privileges
• Possible creation of arbitrary files on the server
• Verification of patch deployment and mail-related privilege reviews required

Technical summary

An authenticated cPanel account holder with mail-related privileges can create arbitrary files on the server through cPanel's EmailTrack functionality, leading to code execution as the root user. This occurs because the EmailTrack functionality does not properly sanitize user input, allowing for SQL injection attacks. The vulnerability affects all supported versions of cPanel/WHM, with patched versions available as of September 2026. Successful exploitation requires authentication and mail-related privileges, but can lead to full server compromise.

Defensive priority

High

Recommended defensive actions

• Update cPanel/WHM to the latest patched version (v11.110.0.143, v11.134.0.55, v11.136.0.39, v11.138.0.4 WP2: v11.138.1.9 or later)
• Review and verify mail-related privileges for authenticated cPanel account holders
• Monitor for suspicious activity related to EmailTrack functionality
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

cPanel's official support article describes the vulnerable EmailTrack functionality in cPanel/WHM, lists affected and patched versions, and provides update instructions. The CVE record was published on 2026-09-02T15:08:49.000Z and has not been modified since then. The vulnerability allows an authenticated cPanel account holder with mail-related privileges to create arbitrary files on the server through cPanel's EmailTrack functionality, leading to potential code execution as the root user. Evidence is based on cPanel's changelog RSS,

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.