9 SEP 2026 — cPanel has disclosed CVE-2026-67401, an SQL injection flaw in its EmailTrack feature that lets an attacker reach root on the server. It is being reported as one hosting account taking over an entire machine, which is right. It also requires a valid account with mail privileges, and on shared hosting that is something you buy for a few dollars a month.
The flaw and what it needs
EmailTrack is the component that records and displays mail delivery activity — routing, delivery status, the log a customer checks when a message does not arrive. The injection is there, and it escalates to root-level control of the server.
Exploitation requires authentication. The attacker needs a cPanel account with mail-related privileges, which rules out anonymous internet-wide exploitation and is the reason this is not being treated as an emergency on the scale of an unauthenticated flaw.
Affected are all supported cPanel and WHM versions before the patched releases 11.110.0.143, 11.134.0.55, 11.136.0.39, 11.138.0.4 and 11.138.1.9. It was reported by the researcher Ali Mustafa.
Authentication is a purchase, not a barrier
On a corporate server, requiring an authenticated account is a meaningful control: an attacker needs credentials they do not have. On shared hosting the business model is selling accounts to anyone with a card.
The precondition is real, and its cost is a month of the cheapest plan. An attacker who wants root on a particular provider's machine can buy a seat on it, and a provider that sells trial accounts lowers the price to nothing.
That does not make it equivalent to an unauthenticated flaw. It leaves a log entry, a payment trail and an account to suspend, which is a genuine difference to a defender. But the "authenticated only" framing implies a barrier that shared hosting does not have.
The tenant boundary keeps failing
This is the second cPanel tenant-isolation failure in five weeks. We covered CVE-2026-58048 in early August, and before that a LiteSpeed plugin escalation in May.
The pattern is structural, not coincidence. A control panel exists to let untrusted tenants administer parts of a shared machine, which means every feature it exposes is an interface between a customer and root, and there are hundreds of them. EmailTrack is not a security feature and it did not need to be to matter.
The consequence lands on people who never made a security decision. A small business whose site sits on a shared server has no visibility into the other accounts on it, no ability to check the panel version, and no contractual right to be told.
Where the value of root actually is
The value of root on a shared server is not the server itself. It is everything the server holds for other people: every site's database credentials, every customer's mail, every certificate private key, and the panel's own account list.
That makes a single machine a better target than its size suggests. A budget server hosting two hundred small sites yields two hundred sets of credentials, and small sites reuse credentials more than large ones do.
It is also why these flaws are worth patching promptly even without reported exploitation. The window between disclosure and a working exploit for an SQL injection with a published affected-version list is usually short, and the population of vulnerable machines is enumerable by anyone who can read a panel version banner.
Why this matters more in this region
Shared cPanel hosting is the default for small business web presence across Southeast Asia, sold through local resellers at prices that do not support a security team. The same is true of the Magento shops we wrote about yesterday, and for the same reason: it is the tier where the software is capable and the operator is not staffed.
A regional reseller may be several layers removed from the machine, buying capacity from a wholesaler who buys from a data centre. Patch responsibility in that chain is frequently unstated, and the customer's contract is with the party furthest from the server.
What to do
Update to the patched release for your branch, which is the whole remediation if the server has not been touched. There is no reported exploitation, so this is a patch rather than an incident.
For anyone running a multi-tenant server, the more useful exercise is the one this keeps prompting. Assume a tenant account is obtainable by an attacker, because it is, and ask what that account can reach — which panel features it exposes, what runs as root, and whether the answer has been checked since the last panel upgrade.
For a customer on shared hosting, the honest position is that you cannot verify any of it. The question worth asking a provider is not whether they are patched but how quickly they patched the last one, and whether they will tell you when they do.
View author profile → · Editorial policy
