cPanel patched a vulnerability on September 8 that let an ordinary hosting account holder, someone with nothing more than mail-related permissions, work their way up to full root control of the entire server. That’s not a small gap. It means a single customer account on a shared server could, in theory, reach every other account sitting on that same machine.
The company traces the flaw, tracked as CVE-2026-67401, to an SQL injection issue inside a feature called EmailTrack. cPanel’s advisory doesn’t specify exactly which privilege level triggers it, and it doesn’t explain the technical chain that turns a database injection into file creation and then into root access, a notable gap in an advisory that’s supposed to help administrators understand what they’re patching.
Here’s why this matters beyond the technical details. On a typical hosting setup, a customer’s cPanel account only controls that customer’s own site. WHM, the tool providers use to manage the whole server, sits above that and normally stays out of reach. Root access changes everything: an attacker could read every account on the machine, quietly plant malware, steal credentials, or slip into other customers’ networks from there.
This marks the third flaw cPanel has disclosed since late July that starts from an ordinary account and escalates to root. An August 27 advisory covering domain parking ended the same way, and a July 30 advisory involving database access let accounts run commands with full administrative privileges. cPanel credited the same researcher, Ali Mustafa, on both this flaw and the August one, though the company hasn’t said whether the two share any underlying code.
For now, no public exploit code has surfaced for this specific flaw, and CISA’s catalog of known exploited vulnerabilities doesn’t list it as of September 8. That’s a thin comfort, though. An earlier cPanel flaw from April sat in that same “no known exploitation” category before turning up in active ransomware campaigns.
Administrators running any supported cPanel or WHM version should update now. cPanel lists the fix under Home, cPanel, Upgrade to Latest Version in WHM, or via command line using /usr/local/cpanel/scripts/upcp –force as root.
