New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root
cPanel patched CVE-2026-67401, an SQL injection vulnerability in EmailTrack that allows authenticated hosting accounts with mail privileges to create arbitrary files and escalate to root access Every supported version of cPanel and WHM is affected, with fixed builds released across release lines 11.110, 11.134, 11.136, and 11.138 This is the third major privilege escalation flaw in cPanel since late July, following an August domain parking vulnerability and a July database flaw, all enabling roo
Analysis
TL;DR
- cPanel patched CVE-2026-67401, an SQL injection vulnerability in EmailTrack that allows authenticated hosting accounts with mail privileges to create arbitrary files and escalate to root access
- Every supported version of cPanel and WHM is affected, with fixed builds released across release lines 11.110, 11.134, 11.136, and 11.138
- This is the third major privilege escalation flaw in cPanel since late July, following an August domain parking vulnerability and a July database flaw, all enabling root code execution from ordinary hosting accounts
- No public exploit code was found as of September 9, and the CVE has not yet been assigned a CVSS score or added to CISA's Known Exploited Vulnerabilities catalog
- cPanel provided no interim mitigation for servers unable to update immediately, unlike its July advisory which offered a temporary workaround
Why It Matters
This vulnerability represents a critical threat to web hosting infrastructure, as a single compromised customer account can lead to complete server takeover with root-level access. For AI practitioners and security professionals managing hosting environments, this underscores the importance of rapid patching cycles and the compounding risk of multiple high-severity flaws in widely deployed control panel software.
Technical Details
- Vulnerability Type: SQL injection in the EmailTrack module, leading to arbitrary file creation and subsequent root code execution
- CVE: CVE-2026-67401, reported by researchers Ali Mustafa (rz1027) and abed1526
- Affected Versions: All supported versions of cPanel and WHM; fixed builds include 11.110.0.143, 11.134.0.55, 11.136.0.39, 11.138.0.4, and WP Squared 11.138.1.9
- Prerequisites: Authenticated hosting account with mail-related privileges is sufficient to exploit the vulnerability
- Update Mechanism: Administrators can update via WHM (Home / cPanel / Upgrade to Latest Version) or command line using
/usr/local/cpanel/scripts/upcp --force - Related Flaws: The August 27 domain parking vulnerability (eval injection) and July 30 database flaw share similar privilege escalation paths to root
Industry Insight
- Hosting providers should prioritize immediate patching across all cPanel/WHM instances and audit logs for signs of prior exploitation, especially given the pattern of multiple rapid-fire vulnerabilities in a short timeframe
- The absence of interim mitigations for unpatched servers highlights a gap in incident response guidance; organizations should consider network segmentation and least-privilege configurations to limit blast radius
- The recurring nature of these flaws (three root escalation vulnerabilities since July) suggests systemic issues in cPanel's security review process, prompting administrators to evaluate alternative control panels or enforce stricter account isolation policies
Disclaimer: The above content is generated by AI and is for reference only.