- The Mess: cPanel patched a flaw in EmailTrack that lets an authenticated account with mail privileges create arbitrary files on the server. The final step is code execution as root.
- The Damage: One compromised hosting account can potentially turn into full control of the entire cPanel server — including every other site living on it.
- The Fix: Update cPanel/WHM immediately to a patched build and investigate systems that remained unpatched after September 8.
Shared hosting has one uncomfortable property:
one server can contain a lot of victims.
CVE-2026-67401 makes that problem considerably worse.
cPanel disclosed the vulnerability on September 8 and confirmed that an authenticated account holder with mail-related privileges can abuse the EmailTrack functionality to create arbitrary files on the server.
Successful exploitation leads to code execution as root.
cPanel says every supported version was affected.
It starts with a normal hosting account
The attacker does not begin with root.
They begin with an authenticated cPanel account that has the required mail privileges.
That could make the vulnerability sound less interesting.
It isn’t.
On a shared hosting server, the account is only one tenant.
The operating system, cPanel/WHM infrastructure and other hosted websites are above it.
CVE-2026-67401 provides a path across that boundary.
The vulnerability is described by cPanel as an SQL injection in EmailTrack, but the vendor’s public advisory keeps the technical details deliberately short. What it does state clearly is the dangerous part: arbitrary file creation followed by root code execution.
The file is the bridge to root
The interesting part of the chain isn’t simply SQL injection.
It’s what the attacker gets to do after exploiting it.
SQL injection → arbitrary file creation → code execution → root
That turns a web-hosting account into an operating-system problem.
Once root is obtained, the attacker is no longer confined to the original customer’s files.
They can potentially access:
- other hosting accounts;
- databases;
- application configuration;
- SSH credentials and keys;
- WordPress installations;
- mail data;
- server logs;
- scheduled tasks;
- system services.
The blast radius therefore depends less on the privileges of the original account and more on how many tenants share the machine.
cPanel patched every supported line
The vendor released fixed builds for its supported branches:
- 11.110.0.143
- 11.134.0.55
- 11.136.0.39
- 11.138.0.4
- WP Squared 11.138.1.9
cPanel explicitly recommends updating to the latest patched version.
That matters because this isn’t a vulnerability where administrators can simply disable an obscure optional feature and forget about it.
The affected product is the control panel itself.
There is no public exploit yet
As of September 9, there is no public exploit code and no confirmed exploitation report identified in current searches.
CVE-2026-67401 also isn’t in the CISA Known Exploited Vulnerabilities catalog at this point.
That’s the good news.
The bad news is that the advisory already gives attackers the important pieces:
The product.
The vulnerable functionality.
The affected versions.
The exploitation consequence.
And the exact patched builds.
For a control panel running on thousands of Internet-facing hosting servers, that is enough information to start digging.
Hosting providers should assume the server is the asset
This is where individual website owners can misunderstand the risk.
If you run one WordPress site on a cPanel server, you may think:
“My WordPress account is compromised.”
That is not necessarily where the incident ends.
If the attacker uses the account to reach root, your hosting server becomes compromised.
And if several customers share that server, the provider now has a multi-tenant incident rather than a single-account problem.
The right response therefore isn’t just:
“Update the customer’s WordPress.”
It is:
“Patch cPanel and investigate the host.”
Check the patch level first
Administrators should verify the actual cPanel version rather than assuming automatic updates succeeded.
cPanel has published the fixed builds specifically because affected release branches need to reach those versions or later.
For servers that were exposed while vulnerable, patching should be followed by investigation for:
- unexpected files;
- modified PHP files;
- new cron jobs;
- unknown SSH keys;
- suspicious processes;
- unexpected users;
- altered WordPress installations;
- outbound connections;
- recently created executables.
A clean patch doesn’t erase evidence of an earlier compromise.
Bugstoday Opinion
cPanel vulnerabilities are rarely just about cPanel.
That’s the problem.
The control panel sits above an entire hosting ecosystem. If an ordinary customer account can cross the privilege boundary and become root, the distinction between “one hacked website” and “the whole server is owned” disappears very quickly.
CVE-2026-67401 currently has no public exploit and no confirmed wild exploitation.
That’s exactly why this is the right moment to patch.
Don’t wait for someone to turn the advisory into a working root exploit.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
- cPanel — CVE-2026-67401: SQL Injection Vulnerability in EmailTrack
- The Hacker News — cPanel EmailTrack root-code-execution analysis
- cPanel Security Advisories — official security update archive
