New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root

Summary: cPanel patched CVE-2026-67401, an SQL injection in EmailTrack that lets an authenticated hosting account with mail-related privileges create files on the server and run code as root, affecting every supported version of cPanel and WHM per the September 8 advisory. The advisory names fixed builds for the 110, 134, 136 and 138 release lines but gives no severity score, no interim mitigation, and no guidance on detecting prior compromise; no CVE record or public exploit code had appeared when The Hacker News checked on September 9.
What's compelling: A single mail-privileged hosting account is enough to reach root on the whole machine, where an attacker can read every account, alter files and databases, create hidden accounts and steal credentials. The April cPanel authentication bypass, which needed no account at all, is already in CISA's KEV catalog with known use in ransomware campaigns, and cPanel has not said whether updating helps a server that was attacked first.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-67401
Related: ⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, Paper Cut Attacks, AI Espionage, and Rootkits Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026