cPanel EmailTrack SQL Injection Enables Root Code Execution

cPanel has patched CVE-2026-67401, an authenticated SQL-injection flaw in its EmailTrack functionality that lets a hosting user with mail-related privileges create arbitrary files and potentially execute code as root. All supported cPanel & WHM versions are affected, creating particular risk for shared-hosting and multi-tenant deployments where compromise of one eligible account could expose other customers and hosted assets.

Fixed builds are available for release lines 11.110, 11.134, 11.136, 11.138, and WP Squared. Administrators should upgrade immediately, review and minimize mail-related privileges, enforce strong authentication and MFA, and investigate eligible accounts and servers for compromise. cPanel has not disclosed the precise required privileges, exploitation chain, compensating controls, or detection guidance; no public exploit, confirmed active exploitation, CVE Program entry, or CISA KEV listing had been identified as of September 9.