Critical cPanel Vulnerability Allows Hosting Accounts to Gain Root Access
Mail-privileged accounts can execute code as root via EmailTrack flaw, patched in latest versions.
1Vulnerability Overview
A critical flaw in cPanel's EmailTrack module allows authenticated hosting accounts with mail privileges to create arbitrary files and execute code as root. The vulnerability, tracked as CVE-2026-67401, affects all supported versions of cPanel and WHM. This gives attackers potential control over entire servers, not just individual hosting accounts. cPanel patched the issue on September 8, 2026, but hasn't disclosed which specific features or privileges are required for exploitation.
2Technical Impact
Successful exploitation grants root-level access, enabling attackers to read all hosting accounts, modify files/databases, create hidden accounts, install malware, and access customer networks. The advisory doesn't explain how an SQL injection leads to file creation and root access. This follows three other cPanel vulnerabilities disclosed since July 2026, all starting from ordinary hosting accounts. The August 27 domain parking flaw similarly resulted in root code execution.
3Affected Versions
The vulnerability impacts cPanel releases 110, 134, 136, and 138. Versions from 11.112.0.0 up to (but excluding) 11.134.0.53 are confirmed vulnerable. While 11.118 and 11.126 lines were patched in July, their current support status is unclear. Administrators must upgrade to the latest version via WHM (Home/cPanel/Upgrade) or by running '/usr/local/cpanel/scripts/upcp --force' as root. No temporary mitigation is provided for servers that can't update immediately.
4Severity Assessment
The CVE record scores this 8.7/10 on the CVSS scale (high severity), though cPanel's advisory omitted this rating. Recent cPanel CVEs are assigned through HackerOne, with scores appearing in CVE records rather than advisories. The August flaw's record published September 1 (five days post-advisory) suggests potential delays in severity communication. No exploit code was publicly available as of September 9, but absence from CISA's Known Exploited Vulnerabilities catalog doesn't guarantee safety.
5Historical Context
This marks cPanel's fourth significant vulnerability since July 2026. The April 2026 flaw (an authentication bypass requiring no account) was used in ransomware campaigns. July 30's database flaw allowed administrative database command execution, while August 27's domain parking issue also led to root access. Repositories claiming working exploits for the July and August flaws were already online by September 9, raising concerns about potential exploit chains.
6Reporting and Credits
Researchers Ali Mustafa (rz1027) and abed1526 reported this vulnerability. Ali Mustafa was also credited in the August flaw's CVE record, though cPanel hasn't confirmed if both issues stem from the same codebase. The August flaw was classified as eval injection, while this is labeled SQL injection. cPanel's documentation mentions EmailTrack for email statistics tracking, but doesn't clarify if this is the vulnerable component.
7Administrative Challenges
The advisory lacks crucial details: whether patching helps previously compromised servers, how to check for compromise, or which specific cPanel features/privileges enable exploitation. This follows a pattern from July's database flaw advisory, which initially provided no mitigation for non-upgradable systems before suggesting MySQL feature removal. Such information gaps complicate risk assessment and incident response for hosting providers.
8Security Implications
This vulnerability underscores the risks of control panel software with root access. As cPanel powers numerous web servers, widespread exploitation could have catastrophic effects. The pattern of multiple privilege escalation flaws in quick succession suggests potential systemic issues in cPanel's security architecture. Organizations must prioritize updates and consider additional monitoring for unusual root-level activities, especially in email-related functions.