CVE-2026-67401
CriticalCVSS 9.9Exploitation Probability (EPSS)
Elevated risk59th percentile - higher than 59% of all known CVEs
Summary
A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component.
Risk Assessment
An attacker with a mail account can gain full root control over the server, leading to complete compromise of the system and all data.
Recommendation
Upgrade cPanel to the latest version containing a fix. Additionally, restrict mail account privileges and monitor logs for suspicious activity.
Other vulnerabilities in cPanel
See all- CVE-2026-87899Critical
cPanel contains an execution with unnecessary privileges vulnerability that allows remote authenticated users to execute arbitrary code with root privileges.
- CVE-2026-58048Critical
Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context.
- CVE-2026-65643High
Eval injection vulnerability in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.
- CVE-2026-58047Medium
HTTP Smuggling in cPanel allows potential leak of credentials.
- CVE-2025-66429High
An issue was discovered in cPanel 110 through 132. A directory traversal vulnerability within the Team Manager API allows for overwrite of an arbitrary file. This can allow for privilege escalation to the root user.
Original NVD description (English source)
A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component
Vulnerability data from NVD (NIST) · CISA KEV · EPSS