cPanel EmailTrack SQL Injection to Root Code Execution

CVE-2026-67401 is a SQL injection vulnerability in cPanel & WHM's EmailTrack feature — the subsystem that monitors and logs email delivery activity. An authenticated cPanel account holder with mail-related privileges can inject malicious SQL through EmailTrack, allowing arbitrary file creation on the underlying server. Because cPanel's internal daemons run with elevated privileges, this file-write primitive chains directly into code execution as root. All supported cPanel/WHM release tiers prior to the September 2026 patches are affected: 11.110.x < 11.110.0.143, 11.134.x < 11.134.0.55, 11.136.x < 11.136.0.39, 11.138.x < 11.138.0.4, and WP2 < 11.138.1.9.

No vendor CVSS score has been published, so there is no official severity baseline to compare against. However, the impact profile — authenticated SQLi escalating to root on a multi-tenant hosting server — places this squarely in HIGH territory. In shared hosting environments, the authentication requirement is nearly cosmetic: any paying customer (or anyone who buys a $5/month hosting plan) gets a cPanel account with mail privileges enabled by default. The blast radius is severe — root on a shared hosting server means access to every tenant's files, databases, email, and credentials. cPanel's own recent history with CVE-2026-41940 (auth bypass, 44,000 servers compromised, 64-day zero-day window) shows that cPanel vulns attract real attacker attention at scale.

Why this verdict

• Authentication barrier is thin, not thick: cPanel is shared-hosting software — any customer paying $5/month gets an account with mail privileges. This is not 'requires domain admin' friction; it is 'requires a credit card' friction. Downward pressure exists but is minimal (~0.5 points).
• Role multiplier (multi-tenant hosting server): cPanel's canonical deployment IS the high-value role. ≥90% of cPanel instances serve multiple tenants. Root on a shared host = compromise of all tenants' files, databases, email, and SSL private keys. Blast radius is tenant→server-wide, potentially affecting hundreds of customers per host. This sets a floor of HIGH.
• Massive exposure surface: Over 1 million cPanel instances are directly internet-exposed per Censys/Shodan. This is not a niche product — it is the dominant hosting control panel. The reachable population is enormous.
• No PoC or active exploitation (yet): The CVE is <48 hours old with no public exploit code. This is the primary factor preventing a CRITICAL assessment. However, cPanel's track record (CVE-2026-41940 was weaponized within weeks) suggests this window may close quickly.
• cPanel's recent exploitation history is alarming: CVE-2026-41940 (auth bypass) led to 44,000 compromised servers and a 64-day zero-day window. Attackers are actively targeting cPanel infrastructure, making future exploitation of this SQLi chain plausible.

Why not higher?

A CRITICAL assessment would require either active exploitation, a public PoC, or unauthenticated access. CVE-2026-67401 requires a valid cPanel account (albeit easy to obtain in shared hosting), and no weaponized exploit exists yet. The chain also involves multiple steps (SQLi → file write → daemon execution) that SELinux/CageFS can interrupt, adding real defensive surface that CRITICAL vulns typically lack.

Why not lower?

A MEDIUM assessment would require either limited blast radius or significant exploitation friction. Neither applies here: root on a multi-tenant server is catastrophic blast radius, the auth requirement is nearly cosmetic in shared hosting, and over 1 million instances are internet-exposed. cPanel's recent history of mass exploitation (CVE-2026-41940) demonstrates that attackers actively target this software at scale.

1. Force-update cPanel immediately via /usr/local/cpanel/scripts/upcp --force — This is the definitive fix. cPanel's auto-update mechanism should have pulled the patch already, but force-updating confirms it. Deploy within 30 days per noisgate mitigation SLA for HIGH, though given the multi-tenant blast radius, same-week is strongly recommended.
2. Audit and restrict mail privileges on cPanel accounts — Review all cPanel accounts and disable EmailTrack / mail-related privileges for accounts that do not require them. This eliminates the prerequisite for exploitation on those accounts.
3. Enable ModSecurity with OWASP or Comodo rulesets — ModSecurity with current SQLi detection rules can catch many injection payloads targeting EmailTrack parameters, providing a detection-and-block layer while patching is staged.
4. Deploy CageFS (CloudLinux) or equivalent filesystem isolation — CageFS virtualizes the filesystem for each cPanel user, limiting the attacker's ability to write files to system directories even if the SQLi succeeds. This breaks the file-write-to-root chain.
5. Enable SELinux in enforcing mode — SELinux policies can prevent MySQL/MariaDB from writing to unexpected directories and prevent cPanel daemons from executing files outside their expected paths, breaking two links in the exploit chain.
6. Enforce MFA on all cPanel account logins — Raises the bar for credential-based account access, making it harder for attackers to obtain the authenticated session needed to reach the vulnerable EmailTrack interface.

Run this script on each cPanel server as root (or via sudo). It checks the installed cPanel build number against the patched versions. Example: sudo bash check_cve_2026_67401.sh

#!/usr/bin/env bash
# check_cve_2026_67401.sh — Detect CVE-2026-67401 (cPanel EmailTrack SQLi)
# Run as root on the target cPanel/WHM server.
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

VERSION_FILE="/usr/local/cpanel/version"

if [ ! -f "$VERSION_FILE" ]; then
  echo "UNKNOWN — cPanel not detected on this host (no $VERSION_FILE)"
  exit 2
fi

VERSION=$(cat "$VERSION_FILE" | tr -d '[:space:]')
echo "Detected cPanel version: $VERSION"

# Extract major.minor.micro.build
IFS='.' read -r MAJOR MINOR MICRO BUILD <<< "$VERSION"

# Normalize to integers, default to 0 if empty
MAJOR=${MAJOR:-0}
MINOR=${MINOR:-0}
MICRO=${MICRO:-0}
BUILD=${BUILD:-0}

# Patched versions per tier:
# 11.110.0.143, 11.134.0.55, 11.136.0.39, 11.138.0.4
check_patched() {
  local major=$1 minor=$2 micro=$3 build=$4
  if [ "$major" -eq 11 ]; then
    case $minor in
      110) [ "$build" -ge 143 ] && return 0 ;;
      134) [ "$build" -ge 55 ] && return 0 ;;
      136) [ "$build" -ge 39 ] && return 0 ;;
      138)
        # Check if WP2 channel (build >= 1000 range) or standard
        if [ "$micro" -eq 1 ]; then
          # WP2 channel: need >= 11.138.1.9
          [ "$build" -ge 9 ] && return 0
        else
          # Standard: need >= 11.138.0.4
          [ "$build" -ge 4 ] && return 0
        fi
        ;;
      *)
        # Version tier > 138 assumed patched
        [ "$minor" -gt 138 ] && return 0
        ;;
    esac
  elif [ "$major" -gt 11 ]; then
    return 0
  fi
  return 1
}

if check_patched "$MAJOR" "$MINOR" "$MICRO" "$BUILD"; then
  echo "PATCHED — cPanel $VERSION is at or above the fix for CVE-2026-67401."
  exit 0
else
  echo "VULNERABLE — cPanel $VERSION is below the patched build. Update immediately:"
  echo "  /usr/local/cpanel/scripts/upcp --force"
  exit 1
fi

Sources

1. SecurityOnline — CVE-2026-67401 Analysis
2. GBHackers — cPanel EmailTrack SQL Injection
3. CyberSecurityNews — cPanel SQL Injection Vulnerability
4. Censys — The cPanel Situation (exposure data)
5. The Hacker News — cPanel Critical Flaw
6. CyberPress — cPanel EmailTrack Flaw
7. CISA KEV Catalog