Critical cPanel Flaw Lets Hosting Accounts Escalate to Root-Level Server Control

Tracked as CVE-2026-67401, the flaw affects the EmailTrack functionality in cPanel and WHM. According to cPanel, an attacker who has access to an eligible hosting account can abuse the vulnerable functionality to create arbitrary files on the server. Successful exploitation can ultimately result in code execution with root privileges, giving the attacker full control over the machine.

The vulnerability is particularly serious for shared-hosting providers because the initial access required is substantially lower than full server administration. A compromised or malicious customer account could potentially cross the security boundary separating an individual hosting account from the entire server.

cPanel published the security advisory on September 8, 2026, and says that all supported cPanel and WHM versions are affected.

---

Key Takeaways

• The vulnerability is tracked as CVE-2026-67401.
• It affects cPanel/WHM EmailTrack functionality.
• An authenticated account with mail-related privileges can potentially exploit the flaw.
• Attackers can create arbitrary files on the server.
• Successful exploitation can lead to code execution as root.
• Root access provides control over the entire server and all hosted accounts.
• All supported cPanel and WHM versions are affected according to cPanel.
• cPanel has released patched builds for supported release branches.
• No CVSS score had been published in the vendor advisory at the time of reporting.
• No public exploit code or confirmed exploitation campaign had been identified at publication time.
• The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog based on the latest available catalog checked for this disclosure.

---

How the Attack Works

The vulnerability creates a dangerous privilege-escalation path:

Authenticated Hosting Account
            ↓
     Mail Privileges
            ↓
       EmailTrack
            ↓
     SQL Injection
            ↓
   Arbitrary File Creation
            ↓
      Code Execution
            ↓
       ROOT ACCESS
            ↓
   Full Server Compromise

The exact technical exploitation details have not been publicly disclosed by cPanel.

However, the vendor confirms that the vulnerable EmailTrack functionality can be abused by an authenticated account holder with mail-related privileges to create arbitrary files on the server. cPanel further states that successful exploitation leads to code execution as the root user.

This creates a critical security boundary violation.

A customer account that should normally be restricted to its own hosting environment can potentially cross into the server's administrative layer.

---

What Is cPanel EmailTrack?

EmailTrack is associated with cPanel's email statistics and tracking functionality.

cPanel provides the platform to hosting customers through individual accounts, while the hosting provider typically manages the underlying server through WebHost Manager (WHM) with root-level administrative privileges.

This separation is fundamental to shared hosting:

                    SERVER
                       │
          ┌────────────┴────────────┐
          │                         │
      WHM / ROOT              cPanel Accounts
          │                         │
     Full Server            Customer Account
      Control                Restricted Access

CVE-2026-67401 threatens that separation.

If an attacker can move from a customer-level account to root, the compromise is no longer limited to a single website or mailbox.

---

Why Root Access Changes Everything

Successful exploitation could provide an attacker with administrative control over the entire host.

Depending on the server configuration, this could allow attackers to:

Access Other Hosting Accounts

An attacker could potentially access websites, databases and files belonging to other customers on the same server.

Modify Websites

Attackers could inject malicious JavaScript, phishing pages, redirects or web shells into hosted websites.

Steal Credentials

Sensitive credentials stored on the server could become accessible, including:

• Database credentials
• Application secrets
• API keys
• SSH keys
• Configuration files
• Email credentials

Install Persistent Malware

Root privileges could allow attackers to deploy malware or establish persistence mechanisms that survive individual account cleanup.

Create Hidden Accounts

Attackers could potentially create additional administrative or system-level accounts for future access.

Modify Databases

Databases belonging to multiple customers could potentially be accessed, altered or destroyed.

Launch Further Attacks

A compromised hosting server could become infrastructure for:

• Phishing
• Malware distribution
• Spam
• Cryptomining
• Credential harvesting
• Botnet activity
• Attacks against other infrastructure

The impact therefore extends well beyond the original vulnerable cPanel account.

---

All Supported cPanel Versions Affected

cPanel's advisory states that all supported versions are affected and provides fixes for the following release branches.

cPanel Release	Fixed Build
11.110	11.110.0.143
11.134	11.134.0.55
11.136	11.136.0.39
11.138	11.138.0.4
WP Squared	11.138.1.9

Administrators should verify the currently installed build rather than assuming that an automatic update has already installed the fix.

---

No CVSS Score Published Yet

Unlike many recent security advisories, cPanel's initial notification does not provide a CVSS severity score for CVE-2026-67401.

A CVE record had also not yet been published in the CVE Program's record store when the vulnerability was initially checked on September 9.

The absence of a CVSS score should not be interpreted as an indication of low risk.

The vendor explicitly states that exploitation can result in root-level code execution and complete server control.

For shared hosting environments, that impact alone warrants urgent remediation.

---

No Public Exploit Identified — Yet

At the time of publication, searches had not identified:

• Public exploit code for CVE-2026-67401
• Confirmed exploitation reports
• A CISA KEV listing for the vulnerability

However, the absence of publicly documented exploitation does not eliminate the risk.

Once vulnerability details become available, attackers may attempt to reverse-engineer the patch or reproduce the attack chain.

The situation is especially important because the vulnerable component is commonly deployed on shared hosting infrastructure, where a large number of customer accounts may exist on a single server.

---

Part of a Larger cPanel Security Pattern

CVE-2026-67401 comes shortly after several other cPanel vulnerabilities that also demonstrate how an authenticated hosting account can potentially cross privilege boundaries.

CVE-2026-65643 — Domain Parking

A vulnerability disclosed in August allowed an authenticated cPanel account with permission to add parked or addon domains to create arbitrary files.

cPanel stated that successful exploitation could result in root-level code execution and complete server control.

CVE-2026-58048 — Database Privilege Escalation

Another recently patched flaw allowed an authenticated account with database functionality to execute database commands with full administrative privileges. Depending on the environment, that could potentially extend to operating-system compromise.

LiteSpeed cPanel Plugin Issues

Earlier in 2026, vulnerabilities in the LiteSpeed cPanel plugin also allowed authenticated cPanel users to escalate privileges to root on affected environments.

Taken together, these incidents highlight the importance of maintaining strict isolation between customer-level functionality and server-level administrative privileges.

---

Shared Hosting Providers Face the Greatest Risk

The vulnerability is particularly concerning for providers operating multi-tenant servers.

A typical shared hosting server could contain:

• Hundreds of websites
• Multiple customer accounts
• Email services
• Databases
• DNS services
• Application environments
• Control-panel APIs

A compromise of one account could therefore potentially become a compromise of the entire server.

The security boundary is supposed to look like:

Customer A ──┐
Customer B ──┼──> Isolated Hosting Accounts
Customer C ──┘
                     ↓
                 Root / WHM
                     ↓
                Administrator

CVE-2026-67401 creates the possibility of:

Customer Account
       ↓
EmailTrack
       ↓
Arbitrary File Creation
       ↓
Root
       ↓
Customer A + B + C + Server

That is why this vulnerability should be treated as a multi-tenant isolation issue, not simply an application-level SQL injection.

---

Recommended Actions for Administrators

1. Patch Immediately

Administrators should upgrade cPanel/WHM to the appropriate fixed build.

The update can be performed through:

WHM → Home → cPanel → Upgrade to Latest Version

cPanel also documents the following command for administrators who need to force the update:

/usr/local/cpanel/scripts/upcp --force

The vendor's official advisory should be used when performing the update.

---

2. Verify the Installed Version

Do not assume the server has received the security update.

Confirm the installed cPanel build and ensure it meets or exceeds the appropriate fixed version.

This is particularly important for providers managing large fleets of cPanel servers.

---

3. Review Existing Hosting Accounts

Identify accounts with:

• Mail privileges
• EmailTrack access
• Additional administrative capabilities
• API access
• Shell access
• Database access

Reducing unnecessary privileges can limit the number of accounts capable of reaching vulnerable functionality.

---

4. Investigate for Prior Compromise

Because the vulnerability could potentially provide complete root access, administrators should consider reviewing systems that remained unpatched after the disclosure.

Look for:

• Unexpected root accounts
• New SSH keys
• Modified system files
• Unknown cron jobs
• Suspicious systemd services
• Recently modified websites
• Unexpected PHP files
• Web shells
• Malware
• Cryptocurrency miners
• Unusual outbound connections

---

SOC Detection and Threat Hunting

Security teams should look beyond the initial cPanel account.

The most important detection scenario is:

Customer-level activity followed by unexpected root-level behavior.

Monitor Privilege Transitions

Investigate unexpected transitions such as:

cPanel Account
      ↓
System Process
      ↓
root

Monitor File Creation

Pay particular attention to unexpected files created outside the customer's normal home directory.

Examples include:

/etc/
/usr/bin/
/usr/sbin/
/var/
/root/
/tmp/

Monitor New SSH Keys

Investigate modifications to:

/root/.ssh/authorized_keys

and other privileged users' SSH configuration.

Monitor Cron Persistence

Look for newly created or modified scheduled tasks in:

/etc/cron.d/
/etc/cron.daily/
/etc/cron.hourly/
/var/spool/cron/

Monitor Web Shell Deployment

Search hosted websites for suspicious:

• PHP files
• Obfuscated code
• eval()
• base64_decode()
• shell_exec()
• system()
• passthru()

These indicators are not proof of exploitation by themselves, but unexpected occurrences following suspicious cPanel activity deserve investigation.

---

Incident Response: What If the Server Was Unpatched?

If you discover that a server was vulnerable for an extended period, simply installing the patch should not automatically be considered sufficient.

Security teams should determine whether the system was compromised before remediation.

A suitable response process is:

Step 1 — Isolate

Restrict suspicious external access where operationally possible.

Step 2 — Preserve Evidence

Collect:

• cPanel logs
• WHM logs
• Authentication logs
• Web server logs
• File-system timestamps
• Process information
• Network connections

Step 3 — Hunt for Root Persistence

Check:

• SSH keys
• Users
• Cron
• Systemd
• Startup scripts
• Kernel modules
• Web shells

Step 4 — Rotate Credentials

Consider rotating credentials potentially accessible from the server, including:

• Hosting account passwords
• SSH credentials
• Database passwords
• API keys
• Application secrets

Step 5 — Rebuild When Necessary

If root-level compromise is confirmed, rebuilding the server from a trusted image may be safer than attempting to clean an attacker-controlled operating system.

---

What Makes This Vulnerability Different?

The technical classification is important.

At its core, cPanel describes CVE-2026-67401 as an SQL injection vulnerability in EmailTrack. However, the security consequence goes far beyond unauthorized database manipulation.

The vendor states that the vulnerability can allow an authenticated account holder to create arbitrary files and ultimately execute code as root.

This illustrates why security teams should evaluate vulnerabilities based on their complete attack chain and resulting privileges, rather than focusing only on the initial vulnerability class.

An SQL injection flaw in an isolated application might expose database information.

An SQL injection flaw that crosses a hosting-account security boundary and leads to root execution is a fundamentally different risk.

---

Vulnerability Quick Reference

Attribute	Details
CVE	CVE-2026-67401
Component	cPanel EmailTrack
Vulnerability Type	SQL Injection
Initial Access	Authenticated cPanel account
Required Privilege	Mail-related privileges
Impact	Arbitrary file creation
Final Impact	Root-level code execution
Server Control	Full
Affected Versions	All supported cPanel/WHM versions
CVSS	Not published by cPanel at disclosure
Public Exploit	None identified at publication
CISA KEV	Not listed at publication
Patch Available	Yes
Disclosure Date	September 8, 2026

---

Bottom Line

CVE-2026-67401 turns a seemingly limited hosting account into a potential gateway to full server compromise.

An authenticated customer with mail-related privileges can potentially abuse cPanel's EmailTrack functionality to create arbitrary files and ultimately execute code with root privileges.

For shared hosting providers, the risk is particularly significant because compromising one server can expose every customer, website, database and mailbox hosted on that machine.

Administrators should upgrade to the appropriate fixed cPanel build immediately and should not wait for public exploit code or confirmed attacks before taking action.

For servers that remained vulnerable for a significant period, patching should be followed by compromise assessment.

The key security lesson is simple: in a multi-tenant hosting environment, an authenticated customer account must never become a stepping stone to root.