{"id":10698,"date":"2026-09-10T22:48:15","date_gmt":"2026-09-11T02:48:15","guid":{"rendered":"https:\/\/hostingdiscussion.com\/news\/?p=10698"},"modified":"2026-09-10T22:48:15","modified_gmt":"2026-09-11T02:48:15","slug":"cpanels-third-root-access-flaw-in-six-weeks-has-no-clear-fix-explained","status":"publish","type":"post","link":"https:\/\/hostingdiscussion.com\/news\/cpanels-third-root-access-flaw-in-six-weeks-has-no-clear-fix-explained\/","title":{"rendered":"cPanel’s third root-access flaw in six weeks has no clear fix explained"},"content":{"rendered":"

cPanel<\/a> patched a vulnerability on September 8 that let an ordinary hosting account holder, someone with nothing more than mail-related permissions, work their way up to full root control of the entire server. That’s not a small gap. It means a single customer account on a shared server could, in theory, reach every other account sitting on that same machine.<\/p>\n

The company traces the flaw, tracked as CVE-2026-67401<\/a>, to an SQL injection issue inside a feature called EmailTrack. cPanel’s advisory doesn’t specify exactly which privilege level triggers it, and it doesn’t explain the technical chain that turns a database injection into file creation and then into root access, a notable gap in an advisory that’s supposed to help administrators understand what they’re patching.<\/p>\n

Here’s why this matters beyond the technical details. On a typical hosting setup, a customer’s cPanel account only controls that customer’s own site. WHM, the tool providers use to manage the whole server, sits above that and normally stays out of reach. Root access changes everything: an attacker could read every account on the machine, quietly plant malware, steal credentials, or slip into other customers’ networks from there.<\/p>\n

This marks the third flaw cPanel<\/a> has disclosed since late July that starts from an ordinary account and escalates to root. An August 27 advisory covering domain parking ended the same way, and a July 30 advisory involving database access let accounts run commands with full administrative privileges. cPanel credited the same researcher, Ali Mustafa, on both this flaw and the August one, though the company hasn’t said whether the two share any underlying code.<\/p>\n

For now, no public exploit code has surfaced for this specific flaw, and CISA’s catalog of known exploited vulnerabilities doesn’t list it as of September 8. That’s a thin comfort, though. An earlier cPanel flaw from April sat in that same “no known exploitation” category before turning up in active ransomware campaigns.<\/p>\n

Administrators running any supported cPanel or WHM version should update now. cPanel lists the fix under Home, cPanel, Upgrade to Latest Version in WHM, or via command line using \/usr\/local\/cpanel\/scripts\/upcp –force as root.<\/p>\n","protected":false},"excerpt":{"rendered":"

cPanel patched a vulnerability on September 8 that let an ordinary hosting account holder, someone with nothing more than mail-related permissions, work their way up to full root control of the entire server. That’s not a small gap. It means a single customer account on a shared server could, in theory, reach every other account […]<\/p>\n","protected":false},"author":20624,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[71],"tags":[6541,8043,8042,4401,8041],"class_list":["post-10698","post","type-post","status-publish","format-standard","hentry","category-featured","tag-cpanel-vulnerability","tag-cve-2026-67401","tag-sql-injection-cpanel","tag-web-hosting-security","tag-whm-root-exploit"],"acf":[],"yoast_head":"\ncPanel's third root-access flaw in six weeks has no clear fix explained - Web Hosting News<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/hostingdiscussion.com\/news\/cpanels-third-root-access-flaw-in-six-weeks-has-no-clear-fix-explained\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"cPanel's third root-access flaw in six weeks has no clear fix explained - Web Hosting News\" \/>\n<meta property=\"og:description\" content=\"cPanel patched a vulnerability on September 8 that let an ordinary hosting account holder, someone with nothing more than mail-related permissions, work their way up to full root control of the entire server. That’s not a small gap. It means a single customer account on a shared server could, in theory, reach every other account […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/hostingdiscussion.com\/news\/cpanels-third-root-access-flaw-in-six-weeks-has-no-clear-fix-explained\/\" \/>\n<meta property=\"og:site_name\" content=\"Web Hosting News\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-11T02:48:15+00:00\" \/>\n<meta name=\"author\" content=\"Justine Juyad\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Justine Juyad\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/cpanels-third-root-access-flaw-in-six-weeks-has-no-clear-fix-explained\/\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/cpanels-third-root-access-flaw-in-six-weeks-has-no-clear-fix-explained\/\",\"name\":\"cPanel's third root-access flaw in six weeks has no clear fix explained - Web Hosting News\",\"isPartOf\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\"},\"datePublished\":\"2026-09-11T02:48:15+00:00\",\"dateModified\":\"2026-09-11T02:48:15+00:00\",\"author\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\"},\"breadcrumb\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/cpanels-third-root-access-flaw-in-six-weeks-has-no-clear-fix-explained\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/hostingdiscussion.com\/news\/cpanels-third-root-access-flaw-in-six-weeks-has-no-clear-fix-explained\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/cpanels-third-root-access-flaw-in-six-weeks-has-no-clear-fix-explained\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/hostingdiscussion.com\/news\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"cPanel’s third root-access flaw in six weeks has no clear fix explained\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/\",\"name\":\"Web Hosting News\",\"description\":\"Cloud and web hosting industry daily news\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\",\"name\":\"Justine Juyad\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"caption\":\"Justine Juyad\"},\"description\":\"HostingDiscussion.com senior reporter\",\"sameAs\":[\"https:\/\/hostingdiscussion.com\/news\/\"],\"url\":\"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"cPanel's third root-access flaw in six weeks has no clear fix explained - Web Hosting News","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/hostingdiscussion.com\/news\/cpanels-third-root-access-flaw-in-six-weeks-has-no-clear-fix-explained\/","og_locale":"en_US","og_type":"article","og_title":"cPanel's third root-access flaw in six weeks has no clear fix explained - Web Hosting News","og_description":"cPanel patched a vulnerability on September 8 that let an ordinary hosting account holder, someone with nothing more than mail-related permissions, work their way up to full root control of the entire server. That’s not a small gap. It means a single customer account on a shared server could, in theory, reach every other account […]","og_url":"https:\/\/hostingdiscussion.com\/news\/cpanels-third-root-access-flaw-in-six-weeks-has-no-clear-fix-explained\/","og_site_name":"Web Hosting News","article_published_time":"2026-09-11T02:48:15+00:00","author":"Justine Juyad","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Justine Juyad","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/hostingdiscussion.com\/news\/cpanels-third-root-access-flaw-in-six-weeks-has-no-clear-fix-explained\/","url":"https:\/\/hostingdiscussion.com\/news\/cpanels-third-root-access-flaw-in-six-weeks-has-no-clear-fix-explained\/","name":"cPanel's third root-access flaw in six weeks has no clear fix explained - Web Hosting News","isPartOf":{"@id":"https:\/\/hostingdiscussion.com\/news\/#website"},"datePublished":"2026-09-11T02:48:15+00:00","dateModified":"2026-09-11T02:48:15+00:00","author":{"@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3"},"breadcrumb":{"@id":"https:\/\/hostingdiscussion.com\/news\/cpanels-third-root-access-flaw-in-six-weeks-has-no-clear-fix-explained\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/hostingdiscussion.com\/news\/cpanels-third-root-access-flaw-in-six-weeks-has-no-clear-fix-explained\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/hostingdiscussion.com\/news\/cpanels-third-root-access-flaw-in-six-weeks-has-no-clear-fix-explained\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/hostingdiscussion.com\/news\/"},{"@type":"ListItem","position":2,"name":"cPanel’s third root-access flaw in six weeks has no clear fix explained"}]},{"@type":"WebSite","@id":"https:\/\/hostingdiscussion.com\/news\/#website","url":"https:\/\/hostingdiscussion.com\/news\/","name":"Web Hosting News","description":"Cloud and web hosting industry daily news","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3","name":"Justine Juyad","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","caption":"Justine Juyad"},"description":"HostingDiscussion.com senior reporter","sameAs":["https:\/\/hostingdiscussion.com\/news\/"],"url":"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/"}]}},"views":97,"_links":{"self":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/10698","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/users\/20624"}],"replies":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/comments?post=10698"}],"version-history":[{"count":1,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/10698\/revisions"}],"predecessor-version":[{"id":10699,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/10698\/revisions\/10699"}],"wp:attachment":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/media?parent=10698"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/categories?post=10698"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/tags?post=10698"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}