cPanel CVE-2026-67401: a mail account becomes root

cPanel CVE-2026-67401 is a SQL injection in the Email Track feature that ends with code execution as root. cPanel published the advisory on September 8 with fixed builds across every supported release line. If you run a cPanel server — or if your client's WordPress site sits on one — this is a today problem, not a this-month problem.

What actually happened

Email Track is the cPanel tool that shows message routing and delivery history. Its query handling accepts injected SQL, and an authenticated account holder with mail privileges can use that to write arbitrary files onto the server. From arbitrary file write to code execution as root is a short, well-worn path. The result is full control of the machine.

The exploitation requirement is the part worth reading carefully. This is not an unauthenticated internet-wide bug — the attacker needs a valid cPanel account with mail access. That sounds reassuring until you count how many valid accounts exist on a typical shared host. Every customer on the box has one. Every stale account from a client who left in 2023 has one. Every set of credentials that leaked in an infostealer log has one.

cPanel shipped fixes across the 11.110, 11.134, 11.136 and 11.138 lines plus WP Squared. Check your exact build against the advisory rather than assuming your tier got the same number as someone else's.

Why it matters for your business

This is the third cPanel privilege-escalation flaw in roughly six weeks, after CVE-2026-65643 in late August. That pattern says something structural: on shared hosting, the boundary between "a customer account" and "the whole server" keeps turning out to be thinner than the pricing page implies.

Two actions, in order. First, confirm the patch actually landed. /usr/local/cpanel/cpanel -V prints the running build; compare it to the advisory and do not accept "auto-update is on" as evidence. If someone else manages the host, ask them for the version string in writing — a support ticket that says "we're aware of it" is not a patched server.

Second, treat this as an account audit trigger. The exploit needs credentials, so credentials are the control you own. Delete accounts for departed clients, drop mail privileges from accounts that never send mail, and force a password reset on anything that has not rotated in a year. On a multi-tenant box, your blast radius is every other tenant's uptime, and their incident becomes your support call.

If a single shared server carries every client site you maintain, this CVE is also a decent argument for separating them.

Sources: cPanel Security Advisory, SecurityOnline.