cPanel published an advisory on September 8 for CVE-2026-67401, a SQL injection bug in its EmailTrack feature. An authenticated hosting account with mail privileges can use it to write arbitrary files on the server, and from there run code as root. It is the third bug of that shape cPanel has patched since August 4.

The fixed builds are 11.110.0.143, 11.134.0.55, 11.136.0.39, 11.138.0.4, and 11.138.1.9 for WP Squared. Every supported branch was affected. Credit goes to two researchers, Ali Mustafa and abed1526. As of September 9 there is no public exploit, no record in the official CVE database, and no entry in CISA's Known Exploited Vulnerabilities list. The Hacker News has the write-up, and cPanel's own notice is on its support site.

Three fixes, one pattern

Line them up.

  • August 4: CVE-2026-58048, CVSS 9.4. Renaming a database dropped the SQL mode, so a customer could run SQL in the database root context. cPanel said that could extend to operating system compromise depending on configuration. The workaround was to revoke the MySQL feature from cPanel users. Credited to Vincent55 Yang.
  • August 27: CVE-2026-65643. Any account allowed to add parked or addon domains could write arbitrary files and get root. The injection was backtick shell commands inside a domain name, submitted through the JSON, form, CGI, or API2 routes. No CVSS, no credit, no CVE record for days.
  • September 8: CVE-2026-67401. SQL injection in EmailTrack, the screen that shows a customer where their mail went. Same result: file write, then root.

Two of the three need nothing more than a default shared hosting account. Adding a domain and checking mail delivery are on every plan I have ever seen. The August 4 bug needed MySQL access, which is also on every plan I have ever seen.

The entry condition in each case is "a customer." On a shared server that is a low bar. Anyone with a credit card or a phished login for one of your existing customers meets it. Breaking into one website gets you one website. Root on the box gets you every account, every site, every database, and every mailbox on it.

What the advisories leave out

cPanel's notices are short. The August 27 one ran about five sentences and the September 8 one is barely longer. Hosting Discussion pointed out at the time that the August advisory had no CVSS score, no workaround, no indicators of compromise, and no command an admin could run to check logs for prior exploitation. The same complaint applies this week. There is no mitigation short of the patch, and there is no way, from the vendor, to tell whether someone used the bug against you before the patch landed.

Compare that with the Phusion Passenger advisory cPanel put out earlier in August, which did include a log check for Apache error logs. They know how to do it. They did not do it here.

"No known exploitation" carries a lot of weight in these notices. It means nobody has told cPanel. It does not mean nobody did it. A bug that turns a $5 account into root on a server with 500 tenants sells, and the people who buy it do not file reports.

The other gap is branch coverage. The 11.118 and 11.126 branches got their last updates on July 29 and 30. They received nothing for the August 27 bug and nothing this week. If you are on one of those, you are not patched and you will not be. Move to a supported branch.

What I would do today

Check your build number, not your update setting. Servers set to automatic daily updates get the new build within a day. But "within a day" is a window, and I have seen enough servers sitting on a stale build because the update script failed on a full disk or a broken repository mirror. Run this as root and compare against the list above:

cat /usr/local/cpanel/version
/scripts/upcp --force

Then go looking for what the vendor did not give you. The August bug went through domain creation, so pull the domain add events from cPanel's access log and look for backticks or anything that does not look like a hostname. The EmailTrack bug is SQL injection through a mail delivery search, so search the same log for EmailTrack calls with quotes or SQL keywords in the parameters. Look for new files in places customers cannot write. Look for new cron entries and new SSH keys for root. None of that proves a clean server. It is what you have.

If you resell or run a small fleet, decide now whether a tenant with mail privileges is a threat model you accept. For most shared hosts the answer has to be yes, because taking mail away from customers is taking away the product. That makes patch speed the whole defense. cPanel ships the fix the same day it publishes the notice, which is good. The bugs keep coming, which is the problem.

Where this leaves cPanel

cPanel is the most common commercial control panel in the business. WebPros' 2026 hosting trends report says 64% of surveyed providers offer it, and Similarweb counts more than 1.57 million sites behind it. The code is old, much of it Perl, and it exposes a wide surface to authenticated users on purpose, because that is what a control panel is for. Three root bugs in five weeks in three different features suggests someone is walking the codebase feature by feature, and finding things.

Two of the three were credited to outside researchers. That is the good version of this story: people are looking, and they are reporting. The bad version is that the same walk is cheap for anyone else, and after this month the incentive to take it is plain.

Microsoft patched 974 CVEs yesterday, a record by a wide margin, and Tenable's Satnam Narang put the year's total above 2,600, more than double the old annual record from 2020. The Hacker News attributes the surge to AI-assisted vulnerability discovery. Finding bugs got cheaper this year, and vendors with big old codebases are feeling it first. cPanel is one of those vendors. I expect a fourth advisory of this shape before the end of October, and I expect it will not come with a detection command either.