CVE-2026-67401 lets an authenticated cPanel account holder with mail privileges create arbitrary files and run code as root. cPanel lists all supported versions as affected and has shipped patched builds. The precondition is an ordinary customer account, which on a hosting platform anyone can buy.
What cPanel Actually Says
The advisory is four short sections, and the two that matter are worth reading in cPanel's own words rather than anyone's summary.
The situation is that an authenticated cPanel account holder with mail-related privileges can create arbitrary files on the server through cPanel's EmailTrack functionality. The impact is that successful exploitation leads to code execution as the root user, giving an attacker full control of the server.
It is filed as a SQL injection, tracked as CVE-2026-67401, and published on 8 September 2026. Ali Mustafa (rz1027) and abed1526 are credited with disclosing it responsibly.
Affected versions are listed as all supported versions of cPanel and WHM. Not a range, not a branch. All of them.
The Boundary That Failed Is the One Shared Hosting Is Built On
Most cPanel advisories are about something an administrator can do wrong. This one is different in kind, and the difference is what should get it onto your Wednesday rather than your backlog.
A cPanel account holder is a customer. On a shared server they are one of dozens or hundreds, and the entire commercial proposition of shared hosting is that those accounts cannot reach each other or reach the machine. That separation is the product.
This bug crosses it in one step. Customer to root, on the box, with full control. Which means every other customer's files, every other customer's database, every other customer's mail, and whatever credentials happen to be sitting on the server.
For a hosting provider that is not a vulnerability in a tool you run. It is a vulnerability in what you sell.
Authenticated Is Not the Reassurance It Sounds Like
The word authenticated does a lot of work in headlines, and here it does less than it looks.
An attacker does not need to steal an account. On most hosting platforms they can buy one for the price of a coffee, with a card, in about ninety seconds. The precondition the advisory describes is satisfied by becoming an ordinary paying customer.
Nor is mail-related privileges a narrow filter. Email comes with practically every hosting package sold, because a package without it would be hard to sell at all.
And there is the population you did not choose. Customer accounts get compromised constantly through reused passwords and credential stuffing, which normally costs that one customer their site. On an unpatched server it now costs you the machine.
If you resell, the picture is worse again, because the person behind an account is not necessarily anyone you have ever transacted with.
Patch, and the Builds That Count
The fix is a version update rather than a patch file, which makes this the easier half of the week.
v11.110.0.143
v11.134.0.55
v11.136.0.39
v11.138.0.4
WP Squared: v11.138.1.9
Find out where you are before you do anything else:
/usr/local/cpanel/cpanel -V
Compare it against the line above for your release tier. The numbers are close enough to each other that reading them quickly is a good way to convince yourself you are patched when you are not, so compare all four components rather than the first two.
If you are behind, the standard update run is:
/scripts/upcp
Servers on the Release or Stable tiers with automatic updates enabled may have taken it already, which is worth checking in WHM under Update Preferences before you schedule a window you do not need. Check the version rather than the setting, since an automatic updater that has been failing quietly for a month still reports as enabled.
What cPanel Does Not Say, and What to Read Into It
Four absences in the advisory, and they do not all mean the same thing.
There is no CVSS score. cPanel does not publish one on these, so this is house style rather than a signal about severity.
There is no report of exploitation in the wild, and the disclosure is credited as responsible. Both point the same way, and that is genuinely good news. Unlike the Magento zero-day last week, where attacks preceded the fix by days, this one appears to have been patched before anyone was using it. The window you are managing is the one between the advisory and your update, not one that opened behind your back.
There is no explanation of the mechanism. cPanel does not say how a SQL injection becomes arbitrary file creation and then becomes root execution, and that is a deliberate and reasonable choice while operators are still patching. Do not read the gap as doubt about the finding.
And as of writing, CVE-2026-67401 has no record at MITRE or NVD. That is normal timing rather than a red flag, since cPanel publish the advisory and the builds first and the registry entry catches up. We checked both, which is the only reason we can tell you it is timing.
If You Run Servers for Other People
Three things worth doing beyond patching your own boxes.
Check every server rather than the ones you remember. The advisory says all supported versions, so a machine running an older release line is not out of scope, it is in a different row of the same table.
Tell your customers you have done it. A short note saying which CVE, when you patched, and that no action is needed from them is worth more than it costs, and it is the difference between a provider people trust and one they merely use.
Then look at the account layer, because patching closes this route and not the reason it mattered. Accounts with weak or reused passwords are the standing supply of authenticated attackers for every bug of this shape, and this is not the last one that will need an account to start from.
Or read how we handle it in cPanel Servers Management.
Related Articles
Eleven npm Packages Compromised in a 53 Minute Attack That Steals Every Credential Your Build Host Can Reach
On August 4, 2026 a worm pushed malicious versions of eleven npm caching packages inside a 53 minute window, harvesting npm tokens, GitHub PATs, AWS credentials, Kubernetes service account tokens and SSH keys. The headline was keyv and its 604 million monthly downloads, but keyv was the safest package on the list: its malicious release was a major version bump that no caret range accepts. The other ten were patch bumps, silently eligible for every dependency range in the ecosystem. That distinction, not the download count, decided who got hit. This is a practical guide to the defenses that actually change the outcome: what your semver range really grants, why npm install and npm ci are not interchangeable, when to disable install scripts and what breaks when you do, and how to check a tree you already have.
SecurityHow to Make an S3 Bucket That Cannot Be Deleted by Accident
Protecting a bucket against a mistake and protecting it against a stolen credential are two different jobs, and the settings that do one do not do the other. This walks through versioning, MFA delete and Object Lock in both of its modes, what each one can and cannot be undone by, and where an attacker with the right permission walks straight through your protection. Several of these settings cannot be reversed once enabled, including one where AWS says the only remaining way to delete the data is to close the account, so the warnings sit next to the commands.
SecurityHow to Automate Certificates for Hundreds of Client Domains
Maximum certificate lifetimes are shrinking on a published schedule, so the number of renewals an agency or host runs each year is about to multiply twice over. This guide covers the pattern that survives it: DNS-01 validation with CNAME delegation, so a customer makes one record once and you never hold their zone credentials. It also covers which Let's Encrypt rate limit you meet first depending on how your names are shaped, why the authorization failure limit turns a small mistake into an outage, and how ACME Renewal Information takes the renewal schedule out of your hands entirely.