cPanel patched a flaw on September 8, 2026 that lets one authenticated hosting account with mail privileges create files on the server and then run code as the root user. Every supported version of cPanel and WHM is affected.
What to Know?
- cPanel’s advisory names CVE-2026-67401 as an SQL injection flaw in EmailTrack that ends in code execution as the root user.
- Patched builds are 11.110.0.143, 11.134.0.55, 11.136.0.39 and 11.138.0.4, plus WP Squared build 11.138.1.9.
- The advisory carries no severity score, no interim step for servers that cannot update, and no way to check for prior compromise.
- Ali Mustafa (rz1027) and abed1526 reported the flaw. Mustafa is also credited on cPanel’s August root code execution bug.
- CISA’s catalog released September 8 omits the flaw, and no public exploit code surfaced in searches on September 9.
How It Happened?
cPanel describes the entry point in one sentence. An authenticated account holder with mail-related privileges “can create arbitrary files on the server through cPanel’s EmailTrack functionality,” the company said in its security advisory. File creation is the pivot, and cPanel says successful exploitation ends in root.
That distinction matters on shared hosting. A customer manages one account through cPanel, while the provider runs the whole machine through WHM as root. An attacker at root level reads every account on the box and harvests credentials.
cPanel’s own title calls the bug SQL injection, yet the advisory never explains how a database injection issue becomes file creation and then root. It also does not name the feature or privilege an account needs.
I discovered and reported
— rz1027 (@the_rz1027) September 9, 2026
CVE-2026-67401
SQLi in cPanel's EmailTrack leading to code execution as root.
Thanks @cPanel team for their professional collaboration on this!https://t.co/8iMWfnymiv#CVE #cPanel #HackerOne #0day #InfoSec
What cPanel Left Unanswered?
Four gaps sit in the advisory, each a decision administrators must now make without guidance:
- Which cPanel feature or privilege actually exposes the vulnerable code?
- What should operators do on servers that cannot update today? The July 30 advisory named an interim step, temporarily removing the MySQL feature from users.
- Are the 11.118 and 11.126 lines still supported? Both were patched in July and unlisted since.
- Does the patched build help a server compromised before the update, and how would anyone tell?
The Third Root Bug Since July
This is the third flaw since late July that starts from an ordinary hosting account. CVE-2026-58048, disclosed July 30, let an account with database access run commands with full administrative privileges. CVE-2026-65643, disclosed August 27, reached root through domain parking and scores 8.7 on CVSS v4.0 in a record published September 1. Repositories advertising working exploits for both were online on September 9, adding to a run of patched high-severity WHM vulnerabilities.
The April flaw is why none of this reads as routine. CVE-2026-41940, an authentication bypass that needed no account at all, sits in CISA’s Known Exploited Vulnerabilities catalog with confirmed ransomware use.
SQ Magazine’s Takeaway
The trust boundary under pressure is the one hosting customers assume exists. Mail privileges are a low bar, granted routinely to accounts never meant to touch anything outside their own directory, and the advisory places root code execution on the far side of it. Absence of exploit code on September 9 is a snapshot, and CVE record data shows cPanel scores arriving days after its advisories.
What’s next is a patching window measured in days. Administrators can update from WHM under Home / cPanel / Upgrade to Latest Version, or log in as root and run /usr/local/cpanel/scripts/upcp –force. Anyone who ran an unpatched build should review mail-related account activity, rotate root and database credentials, and audit for accounts nobody created, because cPanel has published no compromise check. Updating helps reduce risk going forward. It says nothing about what happened before.
