CVE-2026-67401: cPanel EmailTrack SQL Injection Leads to Root Code Execution

Critical SQL Injection in cPanel's EmailTrack Turns Mail Access Into Root

cPanel has disclosed CVE-2026-67401, a critical SQL injection vulnerability in EmailTrack — the mail delivery reporting feature built into cPanel/WHM — that lets an already-authenticated account with mail-related privileges escalate all the way to root code execution on the underlying server. The NVD record, published September 9, 2026, scores the flaw 9.9 (Critical).

Vulnerability Details

According to cPanel's own advisory, an authenticated account holder with mail-related privileges can create arbitrary files on the server through EmailTrack's SQL injection flaw, and successful exploitation "leads to code execution as the root user, giving an attacker full control of the server." Neither cPanel's advisory nor the CVE record spells out exactly how the injected SQL translates into an arbitrary file write — but the practical effect is that a low-privilege mail account, not an administrator, can become root.

Affected Products

cPanel/WHM is patched at:

• 11.110.0.143
• 11.134.0.55
• 11.136.0.39
• 11.138.0.4
• WP Squared 11.138.1.9

Every supported cPanel/WHM release line before these builds is affected — this is not limited to a single branch.

Why This Matters

This is the third cPanel privilege-escalation flaw since July 31, 2026, to turn a single authenticated tenant into root — following CVE-2026-58048 and CVE-2026-65643. On shared hosting and reseller platforms, mail-related privileges are routinely handed to low-trust customer accounts. A bug that converts "can view mail delivery reports" into "owns the box" undermines the entire multi-tenant isolation model that shared hosting depends on. As one analysis put it, cPanel's permission granularity has proven decorative against this class of bug — MySQL access, domain parking, and mail reporting have each, in turn, collapsed into the same effective privilege: root.

No public proof-of-concept or exploitation details have surfaced as of this writing, and the flaw is not yet listed in CISA's Known Exploited Vulnerabilities catalog. Given the low bar for exploitation — any account with mail privileges — that absence of public detail shouldn't be read as low risk.

Remediation

• Upgrade cPanel/WHM to 11.110.0.143, 11.134.0.55, 11.136.0.39, or 11.138.0.4 (whichever tracks your current release line) as soon as possible
• If running WP Squared, upgrade to 11.138.1.9

Interim Mitigations

If an immediate upgrade isn't possible:

1. Audit which accounts hold mail-related privileges and restrict them to accounts that genuinely need EmailTrack access
2. Review recent file-system changes owned by root or created outside normal deployment windows on affected servers
3. Monitor EmailTrack-related logs and database queries for anomalous input patterns
4. Restrict cPanel account creation and privilege delegation on shared/reseller environments until patched

Recommendations for Organizations

• Inventory all cPanel/WHM installations and confirm the running build against the patched versions above
• Patch during the next available maintenance window — this is a root-level compromise, not a data leak
• Review the two related 2026 cPanel privilege-escalation CVEs (CVE-2026-58048, CVE-2026-65643) for overlapping exposure
• Audit hosting accounts with mail privileges for signs of prior abuse

Sources

• The Hacker News — New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root
• GBHackers — cPanel EmailTrack SQL Injection Flaw Lets Attackers Execute Code as Root
• NVD — CVE-2026-67401