# cPanel Patches Critical Vulnerability Allowing Single Account to Seize Entire Server **cPanel** has released patches for a severe vulnerability, **CVE-2026-67401**, that could allow a single authenticated hosting account with mail-related privileges to fully compromise an entire server. The flaw, described as an SQL injection within the **EmailTrack** module, enables attackers to create arbitrary files on the server and subsequently execute code with root privileges.  ## The Vulnerability: CVE-2026-67401 **cPanel** published an advisory on September 8, confirming that all supported versions of **cPanel** and **WHM** were impacted. While the advisory labels it an SQL injection issue in **EmailTrack**, it does not specify which **cPanel** feature or specific privilege an account needs to exploit it. **cPanel**'s developer documentation lists an **EmailTrack** module for email statistics, but it's unclear if this is the affected component. For context, **cPanel** is web hosting control panel software used by customers to manage individual hosting accounts, while **WHM** (Web Host Manager) provides providers with root access to manage the entire machine. ## Implications of Root Access Gaining root access to a server via **WHM** is a critical security breach. As highlighted by security company **Hadrian** in a previous incident, this level of access allows an attacker to: * Read all hosting accounts on the machine. * Modify files and databases. * Create hidden accounts. * Install malware. * Steal credentials. * Pivot into customer networks. ## Patched Versions and Update Instructions **cPanel** has released the following fixed builds: | Release Line | Fixed Build | | :----------- | :------------- | | 11.110 | 11.110.0.143 | | 11.134 | 11.134.0.55 | | 11.136 | 11.136.0.39 | | 11.138 | 11.138.0.4 | | WP Squared | 11.138.1.9 | Server administrators can update their systems through **WHM** under *Home / cPanel / Upgrade to Latest Version*. Alternatively, via the command line, log in as root and run `/usr/local/cpanel/scripts/upcp --force`. ## Lack of Mitigation and Severity Scoring Notably, the advisory does not provide any immediate mitigation steps for servers that cannot be updated promptly. This contrasts with a previous July 30 advisory for a database flaw, where temporary removal of the **MySQL** feature was suggested. The advisory also lacks a severity score. **cPanel**'s recent **CVEs** are assigned through **HackerOne**, with scores typically appearing in the **CVE** record itself. While the **CVE** record for a separate August flaw (also reported by **Ali Mustafa**) was published with an 8.7 out of 10 **CVSS** score, **CVE-2026-67401** had no public record or score at the time of reporting. ## No Public Exploitation (Yet) As of September 9, there was no public exploit code or reports of active exploitation for **CVE-2026-67401**. The vulnerability is also not listed in **CISA's Known Exploited Vulnerabilities catalog**. However, the absence of public exploitation does not rule out its potential use in the wild. A different **cPanel** authentication bypass flaw from April, which required no account, is present in the **CISA** catalog and has been exploited in ransomware campaigns. ## Recurring Root Access Vulnerabilities This is not an isolated incident for **cPanel**. Two other flaws disclosed since late July also allowed escalation from an ordinary hosting account to root access. A July 30 advisory detailed a database flaw, and an August 27 flaw in domain parking also led to root code execution. Publicly available exploit repositories for these two previous flaws were online at the time of checking. **cPanel** credits **Ali Mustafa (rz1027)** and **abed1526** for reporting this latest vulnerability. **Ali Mustafa** was also credited for the August flaw, although **cPanel**'s advisories and **CVE** records classify them as distinct issues (SQL injection vs. eval injection).