cPanel EmailTrack Flaw Gives Mail Users Root Access

What it takes to exploit is almost insultingly small: an authenticated hosting account holding mail privileges. Not a reseller. Not an administrator. A mailbox. From there, cPanel's advisory says exploitation leads to code execution as the root user, which on a shared server means every other tenant on the box.

Key Takeaways

• CVE-2026-67401 is a SQL injection in cPanel's EmailTrack mail delivery report that ends in code execution as root, and the CVE record published September 9, 2026 scores it 9.9 out of 10.
• Every supported cPanel and WHM release line was affected, with fixes in builds 11.110.0.143, 11.134.0.55, 11.136.0.39, 11.138.0.4 and WP Squared 11.138.1.9.
• An attacker needs one authenticated account holding mail privileges, which on a shared server means one cheap plan or one stolen webmail password.
• cPanel's own advisory carried no CVSS score and no explanation of how SQL injection becomes file creation and then root, leaving defenders to write detection rules blind.
• CVE-2026-67401 is the third cPanel flaw since July 31, 2026 to turn a single authenticated tenant into root, after CVE-2026-58048 and CVE-2026-65643.

What Is CVE-2026-67401?

CVE-2026-67401 is a SQL injection in the EmailTrack functionality of cPanel and WHM that lets an authenticated account with mail privileges create arbitrary files on the server and then execute code as root. The National Vulnerability Database record, published September 9, classifies it as CWE-89 and scores it 9.9 with the vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

Read the vector, not the number. Attack complexity low, no user interaction, privileges required low, and scope set to changed, the formal way of saying the flaw escapes the boundary it started inside. Fixed builds are 11.110.0.143, 11.134.0.55, 11.136.0.39, 11.138.0.4 and WP Squared 11.138.1.9. Ali Mustafa (rz1027) and abed1526 are credited with the report.

Why Are Mail Privileges Such a Low Bar?

Because mail privileges are the most widely distributed permission on any shared host. The cheapest reseller plan includes them. Mailbox only customers have nothing else. Every WordPress install that sends a contact form notification lives under an account that has them, and cPanel's own documentation presents Track Delivery as an ordinary self service tool for exactly those users.

No zero day required, no WAF to beat. The attacker only needs to be a customer, and the cheapest plan on a target machine costs a few dollars a month. Authenticated is not a mitigating adjective on a platform that sells authenticated accounts to strangers, the same reasoning that applied to the 21,899 Exchange servers left open to mailbox hijack.

What Is EmailTrack, and Why Did a Reporting Tool Reach Root?

EmailTrack is cPanel's Track Delivery interface, the report a customer opens to trace where a message went and why it bounced. It queries the eximstats database and renders sender address, recipient address, sent and delivery timestamps, sender IP, delivery host IP, spam score, message size, message ID, router and transport. WHM's Tweak Settings defaults retention to 10 days and permits values up to 365,000.

The injectable surface, then, is a search box over a mail metadata table, and that table is shared infrastructure rather than per account storage. The plumbing that logs who your mail went to is the same plumbing that owned the server. How a database bug becomes a file, and why that file runs as root, cPanel has not published.

How Far Does One Account Reach on a Shared Server?

Root on a shared host reaches every tenant on the machine, not only the account that was compromised. The operating system boundary between customers is the entire product on shared hosting, and root is the state in which it stops existing, which is why the CVSS specification reserves the changed scope flag for exactly this case.

• Maildirs, mail queues and Exim delivery logs belonging to unrelated customers, readable as ordinary files.
• Every database on the machine, not only the attacker's own and not only eximstats.
• Plaintext database passwords, SMTP passwords and API keys in other tenants' configuration files.
• Hidden accounts, cron entries and web shells under someone else's document root.

One unpatched box is not one incident. A machine with 200 tenants is 200 notification decisions.

The Third Tenant to Root Bug in Six Weeks

Three cPanel CVEs describe the same terminal outcome through three unrelated features, and their records were published within forty days of each other. That is roughly one tenant to root escalation every thirteen days.

• July 31, CVE-2026-58048, scored 9.4. Database renaming failed to preserve SQL mode, letting a customer with MySQL access run database commands with full administrative privileges.
• September 1, CVE-2026-65643, scored 8.8. An eval injection in domain parking and addon domains, CWE-95, reaching code execution as root.
• September 9, CVE-2026-67401, scored 9.9. SQL injection in EmailTrack, CWE-89, reaching code execution as root.

Different feature teams, different bug classes, identical destination. The conclusion most coverage skipped is that cPanel's permission granularity is decorative against bugs of this shape: MySQL access, domain parking and mail reporting all turned out to be the same privilege in practice.

The scores make the point again: CVE-2026-65643 got 8.8 with scope unchanged, CVE-2026-67401 got 9.9 with scope changed, and both describe one customer reaching root on a multi tenant box.

What the Advisory Leaves Out

cPanel published no CVSS score of its own, no proof of concept, no indicators of compromise and no explanation of the chain from injection to file to root. The 9.9 in circulation comes from the CVE record, not the vendor. Patching before publishing is the right order, but the cost lands on defenders: without a file path, a parameter name or a log signature, an operator cannot answer the only question that matters after patching. Was this already used against me?

No exploit code had surfaced as of September 9, which is a timer rather than a verdict. The Zimbra SNMP flaw that hit 274 mail servers before landing in CISA KEV ran the same sequence: quiet advisory, patch, then mass scanning once someone reversed the diff.

What Should Server Administrators Do Right Now?

Check the build number first, because the release line matters more than the marketing version, then upgrade and audit as though the window was used against you. The fixes ship through the standard update path documented in WHM's Update Preferences.

• Read your exact build. Run /usr/local/cpanel/cpanel -V and compare against the fix for your line. A build below it is vulnerable even when the major version looks current.
• Upgrade, then re read the version. A stalled upcp run is silent.
• Count who holds mail privileges. On most servers the answer is everyone, so write the number down before assuming the precondition narrowed your exposure.
• Audit back to late July, not just to September 8. Review WHM account and mailbox creations across the whole run of these bugs.
• Hunt root owned surprises. Check file integrity baselines, files modified outside package management, and cron entries for every account, not only root's.
• Rotate on suspicion, not proof. If one low privilege account looks odd, treat the machine as compromised and rotate credentials for every tenant.

What This Means for Your Inbox

Almost nobody reading this runs a cPanel server. Almost everybody receives mail from small senders who do, and cPanel sits underneath a large share of that long tail, which makes a bug in its mail reporting tool an inbox story rather than a sysadmin story.

The link is concrete. EmailTrack's data source records, for every message the server handled, who sent it, who received it, when, from which IP and to which host. Reach root on that machine and you inherit the table for however long retention is set. Your address, your correspondent and the timing of your conversation sit in a database on a server you have never heard of and never chose.

The follow on risk is targeting rather than content theft. Delivery metadata reveals which senders you actually engage with, which is raw material for a convincing impersonation. The same dependency on invisible mail infrastructure showed up when an AI found a use after free bug in Exim, the mail server behind more than half the public internet.

Looking Ahead

Watch for a proof of concept, because a patch diff is a roadmap and the gap between a quiet cPanel advisory and mass scanning has historically been weeks rather than months. If one lands, expect CVE-2026-67401 in the CISA KEV catalog shortly after.

Then watch whether cPanel addresses the pattern rather than the CVE. Three escalations to root in forty days through three unrelated features is not three coincidences, and hosting customers are meanwhile trusting a permission model that three separate bugs have walked straight through.