CVSS 9.9: cPanel's EmailTrack Flaw Puts Every Shared Hosting Tenant at Risk

A CVSS 9.9 SQL injection in cPanel's EmailTrack feature, disclosed September 8, 2026, collapses the single most important promise of shared hosting: that one tenant can't touch another. CVE-2026-67401 requires nothing more than a standard hosting account with mail privileges — which, on virtually every shared server, every customer already has. From there, the path to root is a straight line.

What EmailTrack Is

EmailTrack is cPanel's built-in mail delivery tracking system, used to log and audit outbound and inbound email events across accounts on a shared server. It's an operational feature, not something customers interact with directly — but it runs with enough internal privilege that a flaw in its database queries becomes something much worse than a mail problem.

How the Exploit Chain Works

The vulnerability is a classic SQL injection, but the consequence is anything but routine. An authenticated cPanel account holder with mail-related privileges can inject into EmailTrack's underlying queries to create arbitrary files anywhere on the server filesystem. File write access on a Linux system is, in practice, a short hop to code execution — and cPanel confirmed that successful exploitation leads to running code as the root user.

The progression looks like this:

• Attacker holds a valid cPanel account with mail privileges — any standard hosting customer qualifies
• SQL injection through the EmailTrack interface corrupts a query in a way that results in arbitrary file creation
• Attacker writes a cron entry, drops a web shell, or abuses a SUID binary path to escalate execution context
• Code runs as root, giving full administrative control over every account on the server

cPanel's advisory puts it plainly: an authenticated account holder with mail-related privileges can create files of their choosing on the server through EmailTrack and, from there, run code as the root user. There is no ambiguity about what "root" means in a multi-tenant context.

The Shared Hosting Dimension

SQL injections that lead to root are bad on any server. On a shared hosting environment, they're a different category of bad. Multi-tenant hosting runs on the premise of strict account isolation — your files, databases, and processes stay walled off from everyone else's. CVE-2026-67401 cuts straight through that wall.

The prerequisite — an authenticated cPanel account with mail privileges — is not a high bar. On the vast majority of shared hosting setups, every customer account has mail privileges by default. That means the realistic attack surface is any customer on the server, any former employee with an old hosting account, or any attacker who's acquired a customer credential from a previous breach. One leaked password from a forgotten account is enough to compromise every other customer on the same box.

This also means hosting resellers bear the risk even if their own accounts are clean. Every customer they host is only as safe as the weakest credential on the server.

Every Supported Version Was Vulnerable

cPanel confirmed that every supported release line was affected at time of disclosure. Patched builds are available across all active branches:

• Branch 11.110 → 11.110.0.143
• Branch 11.134 → 11.134.0.55
• Branch 11.136 → 11.136.0.39
• Branch 11.138 → 11.138.0.4
• WP Squared → 11.138.1.9

Older branches — including 11.118 and 11.126 — are end-of-life and will receive no fix. Running an EOL cPanel branch means this vulnerability is a permanent condition until you upgrade or migrate the server.

How to Apply the Fix

If your server has automatic updates enabled (the default for most managed cPanel installations), the patch may already be in place. Do not assume — verify. Check your installed version in WHM under Home → cPanel → Upgrade to Latest Version, or force the updater from the command line as root:

After it completes, confirm the installed build matches one of the patched version numbers above. Update failures are silent when a server has locked configuration or an out-of-date library preventing the upgrade — only the version check tells you whether you're actually protected.

The Forensics Gap

cPanel's advisory offers no workaround, no indicators of compromise, and no guidance on detecting prior exploitation. As of September 9, no public exploit code had been released and the CVE had not appeared on CISA's Known Exploited Vulnerabilities catalog. That's somewhat reassuring — but absence from the KEV list is not a clean bill of health. Private exploit code often circulates well before a public proof of concept surfaces, particularly for high-CVSS flaws against infrastructure this widespread.

If your server ran a vulnerable version for more than a day or two after September 8, treat a forensic review as worth the time. Look for unexpected cron jobs added around the disclosure window, new entries in any authorized_keys files, web shells in document roots, unfamiliar SUID binaries, and any files with recent modification timestamps in system directories where cPanel shouldn't be writing. EmailTrack's own logs may show unusual query patterns if they haven't been wiped.

cPanel is installed on an estimated 70 million domains across hundreds of thousands of servers — it's exactly the kind of infrastructure vulnerability that sophisticated attackers prioritize, precisely because the patch window between disclosure and exploitation tends to be short and the blast radius is enormous. At Falcon Internet, this is the kind of flaw our 24x7x365 NOC monitoring is built around: catching the gap between disclosure and remediation before someone else fills it.