Back support.cpanel.net

43187903921559 Security CVE 2026 67401 SQL Injection Vulnerability In C Panel S Email Track Functionality September 8 2026

support.cpanel.net • September 9, 2026

An authenticated cPanel account holder with mail-related privileges can create arbitrary files on the server through cPanel's EmailTrack functionality.

Affected Product Versions

Successful exploitation leads to code execution as the root user, giving an attacker full control of the server.

Update to the latest patched version: How do I update cPanel/WHM?

We would like to thank Ali Mustafa (rz1027) and abed1526 for responsibly disclosing this vulnerability.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical cPanel SQL Injection Vulnerability Allows Root Access cPanel disclosed a critical SQL injection vulnerability, tracked as CVE-2026-67401, affecting its EmailTrack functionality. An authenticated user with mail privileges can exploit this flaw to create arbitrary files on the server, leading to code execution as the root user. This vulnerability impacts all supported versions of cPanel and WHM. The flaw was disclosed on September 8, 2026, and cPanel has released patches for the affected versions. The advisory does not specify how the SQL injection leads to file creation and root access. No public exploit code or confirmed exploitation has been reported as of September 9, 2026. Administrators are urged to update their systems immediately to mitigate risks. 4 sources 72

Extracted Entities

43187903921559 Security CVE 2026 67401 SQL Injection Vulnerability In C Panel S Email Track Functionality September 8 2026

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

Platforms (1)

Vulnerabilities (1)