Critical vulnerability affecting cPanel
A critical vulnerability affecting cPanel would allow an authenticated attacker to perform remote arbitrary code execution on affected systems.
Description
Technical context and vulnerability details
cPanel is a web server management and hosting software suite, widely used to simplify the administration of websites and email accounts. This solution is affected by a vulnerability labeled CVE-2026-67401 resulting from SQL injection in the EmailTrack component. Exploitation of this vulnerability would allow an authenticated attacker with an enabled email account to execute arbitrary code remotely with root privileges. It is classified critical with a severity score of 9.9 according to CVSS V3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Remote arbitrary code execution with elevated privileges;
- Compromise of system integrity;
- Data privacy breach;
- Breach of data availability;
Affected systems
Products, components and targeted versions
- cPanel versions 11.110.x earlier than 11.110.0.143;
- cPanel versions 11.134.x earlier than 11.134.0.55;
- cPanel 11.136.x versions earlier than 11.136.0.39;
- cPanel versions 11.138.x earlier than 11.138.0.4;
- cPanel 11.138.x (WP2) versions earlier than 11.138.1.9;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update cPanel to versions 11.110.0.143, 11.134.0.55, 11.136.0.39, 11.138.0.4, 11.138.1.9 or later;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.