CVE-2026-67401

Think of cPanel’s EmailTrack like a mail “receipt” system that records or tracks activity. This bug lets a malicious user with a normal mail account send specially crafted data that tricks cPanel into running commands on the server as root.
That’s like giving an attacker who only has a regular mailbox the ability to take total control of the whole server.

This matters if you run cPanel on a server that has EmailTrack (email tracking) enabled and you have mail-enabled accounts (mail users) on that server.
The danger is highest when an attacker already has access to a valid mail account on the same cPanel host, because the issue relies on low-level authentication and doesn’t require the attacker to trick anyone into clicking or interacting.
If EmailTrack is not reachable/disabled for mail users, the risk is reduced; if it is enabled and mail users exist on the affected version, treat it as reachable.

This is RED because it allows remote code execution as root through SQL injection in the EmailTrack component, and it can be triggered by an attacker who already has a basic mail account on the server. There is no need for user clicks or other interaction, which makes it straightforward to attempt.
Even though there is no confirmed CVE-specific exploitation report in the provided findings, the impact is full administrative control, so you should patch immediately.