CVE-2026-67401 cPanel CVE debrief

Who should care

cPanel/WHM administrators and users with mail-related privileges should assess exposure and update to patched versions to prevent potential exploitation. cPanel/WHM administrators should review and restrict mail-related privileges for authenticated cPanel account holders and monitor for suspicious activity related to EmailTrack functionality. Security teams should verify patch deployment and user privilege restrictions.

Why it matters

CVE-2026-67401 is a SQL injection vulnerability in cPanel's EmailTrack functionality that allows authenticated users with mail-related privileges to create arbitrary files, potentially leading to code execution as root. cPanel/WHM administrators should update to patched versions and restrict user privileges to prevent exploitation.

• Potential code execution as root user
• Arbitrary file creation on the server
• Full control of the server for an attacker
• Verification of patch deployment and user privilege restrictions required

Technical summary

An authenticated cPanel account holder with mail-related privileges can create arbitrary files on the server through cPanel's EmailTrack functionality, potentially leading to code execution as the root user. This vulnerability is caused by a SQL injection flaw in the EmailTrack functionality. cPanel/WHM administrators should update to patched versions and restrict user privileges to prevent exploitation. The vulnerability has a high impact and requires immediate attention. The official CVE Program record and NIST NVD detail page provide additional information on the vulnerability.

Defensive priority

High priority for cPanel/WHM administrators to update to patched versions.

Recommended defensive actions

• Update cPanel/WHM to the latest patched version (v11.110.0.143, v11.134.0.55, v11.136.0.39, v11.138.0.4 WP2: v11.138.1.9 or later)
• Review and restrict mail-related privileges for authenticated cPanel account holders
• Monitor for suspicious activity related to EmailTrack functionality
• Verify patch deployment and user privilege restrictions
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and cPanel's official source confirm an authenticated SQL injection vulnerability in cPanel's EmailTrack functionality, allowing arbitrary file creation. The vulnerability has a high impact and requires immediate attention from cPanel/WHM administrators. The official CVE Program record and NIST NVD detail page provide additional information on the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.