Back support.cpanel.net

July 30 advisory

support.cpanel.net • September 9, 2026

A privilege escalation vulnerability exists in cPanel & WHM's database management functionality.

Affected Product Versions

An authenticated cPanel account holder with access to the MySQL/MariaDB database feature could potentially execute arbitrary database commands with full administrative privileges. Depending on the operating system and database engine configuration, this may extend to operating-system-level compromise.

Update to the latest patched version: How do I update cPanel/WHM?

Servers that cannot immediately upgrade can temporarily revoke the "MySQL" feature from cPanel users. This will not disable existing databases but just prevent adding/removing. To do so, you can follow the steps here: How to edit a feature list

WebPros thanks Vincent55 Yang for responsibly disclosing this issue.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical cPanel SQL Injection Vulnerability Allows Root Access cPanel disclosed a critical SQL injection vulnerability, tracked as CVE-2026-67401, affecting its EmailTrack functionality. An authenticated user with mail privileges can exploit this flaw to create arbitrary files on the server, leading to code execution as the root user. This vulnerability impacts all supported versions of cPanel and WHM. The flaw was disclosed on September 8, 2026, and cPanel has released patches for the affected versions. The advisory does not specify how the SQL injection leads to file creation and root access. No public exploit code or confirmed exploitation has been reported as of September 9, 2026. Administrators are urged to update their systems immediately to mitigate risks. 5 sources 72

Extracted Entities

July 30 advisory

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

Platforms (4)