CVE-2026-67401

Think of cPanel’s EmailTrack like a mail “receipt” system that records or tracks activity. This bug lets a malicious user with a normal mail account send specially crafted data that tricks cPanel into running commands on the server as root.
That’s like giving an attacker who only has a regular mailbox the ability to take total control of the whole server.

This matters if you run cPanel on a server that has EmailTrack (email tracking) enabled and you have mail-enabled accounts (mail users) on that server.
The danger is highest when an attacker already has access to a valid mail account on the same cPanel host, because the issue relies on low-level authentication and doesn’t require the attacker to trick anyone into clicking or interacting.
If EmailTrack is not reachable/disabled for mail users, the risk is reduced; if it is enabled and mail users exist on the affected version, treat it as reachable.

This is RED because it allows remote code execution as root through SQL injection in the EmailTrack component, and it can be triggered by an attacker who already has a basic mail account on the server. There is no need for user clicks or other interaction, which makes it straightforward to attempt.
Even though there is no confirmed CVE-specific exploitation report in the provided findings, the impact is full administrative control, so you should patch immediately.

1. Confirm exposure

   • In your cPanel server, record the exact cPanel version.
   • Check whether the EmailTrack (email tracking) component/feature is enabled for mail-enabled accounts.
   • Confirm whether you have any mail users on this server that can use email tracking.

2. Determine the fixed upgrade target

   • Upgrade cPanel to the fixed release that applies to your update branch:
     • 11.134.0.55
     • 11.136.0.39
     • 11.138.0.4
     • 11.138.1.9
     • 11.110.0.143

3. Upgrade guidance

   • Apply the upgrade as soon as possible using your standard cPanel update process.
   • After upgrade, re-verify:
     • cPanel reports the new version.
     • EmailTrack is still enabled if you require it.

4. Temporary workaround (if patching cannot be immediate)

   • Disable/turn off EmailTrack (email tracking) for the affected cPanel host (or for mail users, if you can scope the setting).
   • Keep it disabled until you finish upgrading to one of the fixed versions listed above.

5. Post-upgrade checks

   • Review the cPanel and system logs for unusual EmailTrack activity and any database-related errors or unexpected process executions.
   • Look for signs of persistence (new scheduled tasks, unexpected binaries/scripts, or modified system files), especially if you notice suspicious log entries.

6. Monitoring going forward

   • Watch for continued abnormal EmailTrack/database patterns after the upgrade.
   • If you have many cPanel hosts, prioritize those with the highest number of mail-enabled accounts.

Severity is critical in practice because the issue is remote code execution as root. The weakness is SQL injection (CWE-89) in cPanel’s EmailTrack component, where crafted inputs from a mail-enabled account can manipulate database requests to reach command execution.

Attack prerequisites from the findings:

• Network-accessible attack surface.
• Low authentication requirement: the attacker must have valid access to a basic email (mail-enabled) account that can reach the EmailTrack component.
• No user interaction required.

Exploitation status:

• No KEV listing in CISA KEV.
• No public exploit code on record in the findings.
• No CVE-2026-67401–specific exploitation incident is reported in the provided news findings (though a different cPanel flaw was mentioned as exploited elsewhere).

Patch status:

• Fixed in cPanel versions: 11.134.0.55, 11.136.0.39, 11.138.0.4, 11.138.1.9, and 11.110.0.143.

What KEV absence means here:

• KEV not listed means this vulnerability is not confirmed in the KEV program based on the provided findings; however, due to the root-level impact and straightforward prerequisites, it should still be treated as an urgent patch.