Loading vulnerability…
Authenticated SQL injection leading to root code execution in cPanel & WHM EmailTrack
CVE-2026-67401 is an SQL injection vulnerability in the EmailTrack functionality of cPanel & WHM. An authenticated hosting account with mail-related privileges can exploit the flaw to create arbitrary files on the underlying server and potentially execute code as root. All supported release lines were affected before their corresponding security updates. The exact vulnerable function, request parameters, SQL statement, and exploitation chain from file creation to root execution have not been publicly detailed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can fully compromise the hosting server, bypassing the separation between a hosting account and server administration. Root-level access can expose hosted websites, databases, email accounts, backups, configuration data, and stored credentials. On shared-hosting systems, the compromise can extend to other tenants and administrative control of WHM.
If you can’t patch tonight, do this now.
No complete vendor-provided temporary workaround is identified. Remove unnecessary mail-related privileges, restrict access to administration interfaces, and enforce strong authentication and MFA. These measures reduce exposure but do not replace patching; interface access restrictions alone do not prevent exploitation by an authorized hosting account. Monitor for unexpected file creation, unusual privileged processes, anomalous EmailTrack activity, and suspicious account or administrative actions.
Patch, then assume compromise.
Upgrade to the fixed build for the installed release line or a later patched build: cPanel & WHM 11.110.0.143, 11.134.0.55, 11.136.0.39, 11.138.0.4, or WP Squared 11.138.1.9. Updates can be applied through WHM's update function or the cPanel update script as root. Investigate previously vulnerable servers for unauthorized file changes, suspicious authentication and administrative activity, and root-level persistence. Applying the update prevents further exploitation but does not remove an existing compromise.
2 exploits validated by Mallory's analysis. Hidden: 3 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
44 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.