One Hosting Account Could Become Root on the Entire cPanel Server
A customer account on a shared hosting server should not be able to become the server administrator. cPanel has patched a vulnerability that crossed exactly that boundary.
According to cPanel’s CVE-2026-67401 security advisory, an authenticated cPanel account holder with mail-related privileges could use the EmailTrack functionality to create arbitrary files on the server. Successful exploitation leads to code execution as the root user and full control of the server.
All supported cPanel and WHM versions were affected. The update is therefore not limited to one old branch or an unsupported installation that administrators can isolate at the edge of an inventory.
The dangerous account is not necessarily an administrator
The attack requires an authenticated cPanel account with mail-related privileges. It does not begin with unauthenticated access to WHM, and cPanel’s notice does not say that every hosting customer can use the path.
That prerequisite still matters in a shared-hosting environment. A customer account can be compromised through password reuse, phishing, a vulnerable website, a stolen session or insecure automation. Once an attacker controls an eligible account, the vulnerability can turn a tenant-level foothold into server-level authority.
Root access collapses the isolation that customers expect from the platform. It can expose website files, databases, mail, backups, configuration, credentials and logs belonging to other accounts on the same server. The precise downstream impact depends on the server layout and additional isolation controls, but cPanel describes the endpoint as full server control.
Email tracking became a file-creation primitive
cPanel identifies the vulnerable feature as EmailTrack and classifies the issue as SQL injection. The public notice does not explain the exact query, destination path or file format used to cross from the feature into arbitrary file creation.
The important operational fact is the primitive that cPanel confirms. If an attacker can create a file at an attacker-chosen location and the system later interprets that file in a privileged context, a data-handling feature can become code execution. On a hosting control plane, the affected context is root.
Technical details may remain limited while customers update. Administrators should not delay remediation while waiting for a public proof of concept. They already have the affected scope, the privilege prerequisite, the impact and the fixed versions.
Five maintained branches received fixes
| Product line | Patched version |
|---|---|
| cPanel and WHM 110 | 11.110.0.143 |
| cPanel and WHM 134 | 11.134.0.55 |
| cPanel and WHM 136 | 11.136.0.39 |
| cPanel and WHM 138 | 11.138.0.4 |
| WP Squared 138 | 11.138.1.9 |
cPanel tells customers to update to the latest patched version. Administrators should compare the full installed build with the fixed build for their branch. A server that reports only the major branch number has not provided enough evidence.
Hosting providers also need to verify update success across clusters, standby nodes, reseller platforms and systems excluded from automatic maintenance. A control panel that starts normally after an update is not proof that every node reached the intended build.
Patching closes the flaw, not the investigation
cPanel does not report active exploitation in the advisory. BlackTree found no credible public proof of concept during the 9 September review. That means defenders should describe exploitation as unconfirmed, not impossible.
Servers that hosted untrusted customers or showed signs of account compromise before the update deserve additional review. The public notice does not provide indicators of compromise, so the investigation must begin with normal evidence sources: cPanel access logs, account sessions, authentication events, unexpected files, privileged process activity and changes outside the affected tenant’s ordinary paths.
If suspicious activity is found, rotate credentials that could have been reached from the host, preserve logs outside the server and assess every customer environment that shared the compromised control plane. A root-level attacker can alter local evidence, so a clean file scan alone cannot settle the question.
What hosting teams should do now
- Inventory every cPanel, WHM and WP Squared server, including standby and reseller systems.
- Update each server to the patched build for its maintained branch or to a newer supported build.
- Verify the complete running version after the update and retain evidence of the change.
- Review which customer and reseller accounts have mail-related privileges that reach EmailTrack.
- Investigate recent compromises of eligible accounts, especially where authentication or session anomalies predate the patch.
- Inspect privileged process activity and unexpected file creation outside normal account paths.
- Keep control-plane access behind additional network and identity controls where operationally possible.
- Follow cPanel for any later indicators, technical detail or revised remediation guidance.
The uncomfortable part of this issue is not simply that a control panel contained a SQL injection. It is that a feature used by one hosting account could reach the highest privilege on a machine serving many others.
Shared hosting depends on boundaries that remain reliable after one customer is compromised. This patch repairs one boundary. Providers still need to prove that it reached every server and decide whether any eligible account crossed it before the fix arrived.
Sources
- cPanel security advisory for the EmailTrack vulnerability, published 8 September 2026 at 14:41. The page does not display a timezone.
- The Hacker News: New cPanel flaw lets hosting account gain root-level code execution, published 9 September 2026. The page provides a date but no precise publication time.
