CVE-2026-67401 turns a cPanel mail account into root through EmailTrack
On September 8, 2026, cPanel disclosed a SQL injection in EmailTrack that lets any mail-account holder write arbitrary files and then execute code as root. Every supported version is affected: on shared hosting, each customer account becomes a doorway to the whole server.
September 8, 2026. cPanel publishes an advisory for CVE-2026-67401, a SQL injection in EmailTrack. September 9, 2026. The CVE record is published with a CVSS 9.9 (Critical). Every supported version is affected. Why it matters: the chain starts from an ordinary mail account and ends in root code execution on the whole server.
The distance from a mail account to root
cPanel’s advisory is one sentence worth reading verbatim: “an authenticated cPanel account holder with mail-related privileges can create arbitrary files on the server through cPanel’s EmailTrack functionality,” and “successful exploitation leads to code execution as the root user, giving an attacker full control of the server.”
EmailTrack is the subsystem behind the “Track Delivery” feature, which lets an account holder review delivery logs and reports for their own mail, sourced from the eximstats database. The injection sits there: by manipulating the tracking parameters, the attacker gets a forged SQL query to write a file to disk — the classic INTO OUTFILE turned into arbitrary file creation. From that file, the path to root code execution is short.
The vector is CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H: remotely exploitable, no interaction, a low-privilege account, and a scope-changing impact — the leap from one account to the entire host. CWE-89 (SQL injection) is confirmed. Discovery credit goes to Ali Mustafa (rz1027) and abed1526.
Every supported version is affected
Some advisories affect one release line; this one is different. The “affected” column reads “all supported versions”, which means being current was no protection. Diligence exempted no one: the only option was patching after the fact.
The patched builds are v11.110.0.143, v11.134.0.55, v11.136.0.39, v11.138.0.4, and v11.138.1.9 for the WP2 line. A server on the 11.136 branch must be at build 39 or higher.
One detail stands out: cPanel’s advisory publishes neither a CVSS score nor a severity rating, unusual for a bug whose stated impact is root code execution. The CVSS 9.9 comes from the CVE record published the next day. The missing score changes nothing about the conclusion: low privilege in, full server control out.
The timeline confirms a classic embargo procedure: the bug was reserved on July 29, 2026 through the bug bounty program, roughly six weeks before the September 8 publication. The vendor’s time went to producing the patched builds, not to communicating.
Technically, the INTO OUTFILE write works because EmailTrack’s queries run with the privileges of the cPanel daemon, far above those of the account. That asymmetry — a low-privilege account querying a database with elevated privileges — is what turns a simple SQL injection into file creation, then into root execution. Control panels are not an isolated target: they are the multi-tenant chokepoint, and a single flaw there is worth hundreds of sites.
Shared hosting turns the threat around
On a single-tenant server, requiring an authenticated account is a real barrier: the only people who can start the chain are the ones you already control.
On shared or reseller hosting, that barrier disappears. Every customer on the machine already holds a mail account — that is what they bought. The question is no longer “can an attacker get an account” but “are the several hundred accounts on this server, and everyone who has ever reused one of those passwords elsewhere, all trustworthy and uncompromised”. One weak password on one unrelated site supplies the whole chain.
That is the point to sit with if you host a Magento or WordPress site on shared hosting: your security is not a function of your own diligence, but of the least careful tenant on the same machine. Compromising a neighboring account yields root on the host, and therefore your site.
How to check and patch
The first action is to know the exact build number, not a general assurance.
# As root: print the running cPanel version
/usr/local/cpanel/cpanel -VCompare the result against the patched build for your branch. Without shell access, WHM shows the running version on its home screen. On shared hosting, ask your provider for the build number and the time it was applied, not a reassuring “we’re patched”.
Then look for what the bug actually does: write files. Anything unexpected and recently created under a web-accessible path deserves inspection — the same instinct recommended during the StyleSmuggler sweep. Arbitrary file creation is the mechanism here, so the indicator of compromise is a file that should not exist.
What to look for in the logs
Because the injection ends in arbitrary file creation, the indicator of compromise is not an anomalous connection but a file that should not exist. The first targets of an INTO OUTFILE write are web-served paths: public_html, theme directories, or a .php dropped into a cache folder.
Concretely, look for files created or modified after September 8 in web trees, unusual setuid binaries, and any cron job newly added by a cPanel account. The eximstats database itself may carry traces of the forged query in its request logs. On shared hosting, the audit must cover every account, not just yours: the attacker needs only the weakest account to reach root on the host.
Verdict
CVE-2026-67401 is a case study in what a shared trust boundary means: the security barrier between tenants is only as strong as the weakest account.
If you administer a cPanel server, check the build now, apply the patch, then audit recently written files under web paths. If you are on shared hosting, demand the build number and application time from your provider, and treat silence as information about how the next flaw will be handled. And if you run an online store, remember that your trust in the platform ends where the least careful account on the same server begins.