CVE-2026-67401Patch

HIGHCVSS 9.9 · CRITICAL

Exploitation observed; activity peaked at 18 mentions and remains active

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component

Back to dashboard

7.8/ 10 priority

Sources & remediation

Other references

https://support.cpanel.net/hc/en-us/articles/43187903921559-Security-CVE-2026-67401-SQL-Injection-Vulnerability-in-cPanel-s-EmailTrack-Functionality-September-8-2026

Weakness type (CWE)

CWE-89

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Active exploitation appears in 1 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
35 mentions across 9 observed days

What's happening

Active exploitation reported across 1 signal
Exploit tool or code specified in 2 signals
PoC mentioned or linked in 3 signals
Patch or workaround mentioned in 21 signals
Technical details provided in 31 signals
Disclosure: 12 classified signals
General: 1 classified signal
Peaked 7d ago at 18 mentions (2026-09-09); latest day: 3
35 total mentions across 9 days

Deep dive

Activity timeline35 mentions / 9d

Signal classification6 categories

Patch

1650.0%

Disclosure

1237.5%

General

13.1%

Active Exploitation

13.1%

Exploit

13.1%

PoC

13.1%

Referenced assets22 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-08	5	Disclosure1General1Patch3
2026-09-09	18	Active Exploitation1Disclosure5Patch12
2026-09-10	3	Disclosure3
2026-09-11	1	Disclosure1
2026-09-16	1	Disclosure1
2026-09-17	1	Disclosure1
2026-09-24	2	Exploit1PoC1
2026-09-30	1	Patch1

Full discourse20 posts

Ryx@PadhiyarRushi31d
PoC
cPanel mail privileges → SQLi → arbitrary file write → root RCE!!! CVE-2026-67401 is the kind of privilege-boundary bug defenders should pay attention to. An authenticated cPanel account with mail privileges can abuse EmailTrack to create arbitrary files, ultimately leading to code execution as root. Affected: all supported cPanel/WHM versions. Fixed builds: • 11.110.0.143 • 11.134.0.55 • 11.136.0.39 • 11.138.0.4 • WP2 11.138.1.9 A public lab repo now includes detection and the exploitation chain! https://github.com/imbas007/CVE-2026-67401 #Cybersecurity #Infosec #AppSec #RCE #cPanel
Post summary
CVE-2026-67401 is a cPanel privilege-boundary bug enabling authenticated users with mail privileges to achieve root RCE via EmailTrack abuse and arbitrary file writing; a public lab repo has published the exploitation chain, and fixed builds are available.
0230133515.1K
954 followersView on X
The Hacker News@TheHackersNews46d
Disclosure
‼️Warning: New CVE-2026-67401 vulnerability in cPanel lets mail-privileged hosting accounts execute code as root. cPanel says every supported cPanel & WHM version is affected and has released fixed builds. Read details here: https://thehackernews.com/2026/09/new-cpanel-flaw-lets-hosting-account.html
Post summary
A newly disclosed CVE‑2026‑67401 in cPanel allows mail‑privileged hosting accounts to execute code as root; all supported cPanel & WHM versions are affected, and patches have been released.
6242761829.9K
2.4M followersView on X
Rıdvan Yağlı@ridvanyagli46d
Patch
🔴 cPanel/WHM'de kritik güvenlik açığı: CVE-2026-67401 cPanel'in EmailTrack işlevinde bulunan SQL Injection açığı, kimliği doğrulanmış ve mail yetkilerine sahip bir cPanel kullanıcısının sunucuda keyfi dosyalar oluşturmasına ve devamında root yetkisiyle kod çalıştırmasına olanak sağlayabiliyor. İstismar başarılı olur ise saldırgan sunucuda tam kontrol sağlayabiliyor. Desteklenen cPanel sürümleri için güvenlik yamaları yayınlandı; özellikle hosting sunucularında cPanel/WHM'in güncel sürüme yükseltilmesi kritik önem taşıyor. CVE: CVE-2026-67401 Etkisi: Root seviyesinde kod çalıştırma / sunucu ele geçirme Öneri: cPanel/WHM'i yamalı sürüme güncelleyin. Duyuru: https://support.cpanel.net/hc/en-us/articles/43187903921559-Security-CVE-2026-67401-SQL-Injection-Vulnerability-in-cPanel-s-EmailTrack-Functionality-September-8-2026
Post summary
The post announces a critical SQL injection in cPanel’s EmailTrack that can grant root execution to an authenticated user, and notes that security patches are available.
19052283.3K
2.4K followersView on X
ZoomEye@zoomeye_team39d
Disclosure
🚨Critical cPanel EmailTrack SQL Injection (CVE-2026-67401) Enables Root Remote Code Execution Critical Vulnerability Alert! cPanel (WebPros) is affected by CVE-2026-67401. 🔍 Identify Targets via ZoomEye: Search Dork: app="cPanel" Exposure: 10m instances identified globally. ZoomEye Search Link: 👉 http://zoomeye.ai/searchResult?q... #Infosec #CyberSecurity #ZoomEye@zoomeyebot
Post summary
The text announces a critical cPanel EmailTrack SQL injection vulnerability (CVE-2026-67401) with root RCE impact and provides exposure/target search details, but lacks PoC, exploit, patch, active exploitation, or false-positive indicators.
07050222.6K
12.7K followersView on X
ZoomEye@zoomeye_team38d
Disclosure
@zoomeyebot 🚨 Critical cPanel EmailTrack SQL Injection (CVE-2026-67401) Enables Root Remote Code Execution Critical Vulnerability Alert! cPanel (WebPros) is affected by CVE-2026-67401. 📷 Identify Targets via ZoomEye: Search Dork: app="cPanel" Exposure: 10m instances identified globally. ZoomEye Search Link: 📷https://zoomeye.ai/searchResult? q=YXBwPSJjUGFuZWwi #Infosec #CyberSecurity #ZoomEye
Post summary
The tweet announces CVE-2026-67401 as a critical cPanel SQL injection enabling remote code execution, provides ZoomEye search guidance for identifying exposed instances, but contains no evidence of active exploitation, PoC code, named exploit tools, or available patches.
0301072.8K
12.7K followersView on X
Netlas.io@Netlas_io44d
Disclosure
CVE-2026-67401: SQL Injection Vulnerability in cPanel, 9.9 Rating 🔥 A vulnerability in cPanel's EmailTrack component allows an authenticated attacker with mail-related privileges to create arbitrary files on the server via SQL injection. This may lead to code execution as the root user, giving the attacker full control of the server. 👉 https://nt.ls/dIEpd
Post summary
The post discloses a SQL injection flaw in cPanel’s EmailTrack component that allows a privileged user to create files and potentially execute code as root. No PoC, exploit, patch, or active exploitation information is provided.
02066721
7.8K followersView on X
Hüseyin Mert@hmert46d
General
@onurryildirim_ Emailden root oluyor. Daha üstü yok! (son sözleri) https://support.cpanel.net/hc/en-us/articles/43187903921559-Security-CVE-2026-67401-SQL-Injection-Vulnerability-in-cPanel-s-EmailTrack-Functionality-September-8-2026
Post summary
The tweet references CVE-2026-67401, a SQL injection in cPanel’s EmailTrack that could lead to root access, but offers no PoC, exploit code, active exploitation evidence, or patch details.
10044512
10.2K followersView on X
Rıdvan Yağlı@ridvanyagli30d
Exploit
🔴 CVE-2026-67401 — cPanel/WHM EmailTrack SQL Injection -> Root RCE için PoC / exploit GitHub'da geçen hafta yayınlandı. Henüz güncelleme yapmamış olanlarınız varsa mutlaka cPanel versiyonlarını güncellesin.
Post summary
CVE‑2026‑67401, a SQL injection in cPanel/WHM EmailTrack that can lead to root RCE, now has a publicly available PoC/exploit posted on GitHub, prompting users to update their cPanel versions immediately.
01040455
2.5K followersView on X
Misbar | مسبار@MisbarSec45d
Patch
📌 ثغرة جديدة في cPanel تسمح للمهاجم بالسيطرة الكاملة على الخادم 🛡️ الفئة: ثغرة 📝 الملخص: كشف cPanel عن ثغرة حقن SQL حرجة (CVE-2026-67401) في مكوّن EmailTrack، تمكّن المهاجمين الموثقين من الحصول على صلاحيات root على الخوادم المتأثرة. تتطلب الاستغلال وجود حساب cPanel صالح مع صلاحيات بريدية، ما يحدّ من الهجمات غير الموثقة. تم الإعلان عن الثغرة في 8 سبتمبر 2026، وتؤثر على جميع خوادم cPanel التي تستخدم EmailTrack. دعت cPanel إلى تطبيق التصحيح فوراً وتفعيل مراقبة الأنشطة المشبوهة. — يُنصح بتحديث الأنظمة المتأثرة وتطبيق سياسات الحد الأدنى للامتيازات. 🗓️ تاريخ النشر: 09/09/2026 🔗 للمزيد: https://cybersecuritynews.com/?p=162667
Post summary
cPanel disclosed a critical SQL injection flaw (CVE‑2026‑67401) in EmailTrack that lets authenticated users gain root access. cPanel advises immediate patching and monitoring of suspicious activity.
00041510
460 followersView on X
ExploitGrid@exploitgrid16d
Disclosure
ExploitGrid Daily Digest 🚨 Top Exploits: CVE-2025-55182 (CVSS: 10) Meta CVE-2026-67401 (CVSS: 9.9) WebPros CVE-2017-5638 (CVSS: 9.8) Apache Softw... CVE-2018-7600 (CVSS: 9.8) n/a CVE-2021-42013 (CVSS: 9.8) Apache Softw... ..🧵👇
Post summary
The digest lists several CVEs with vendor names and CVSS scores. It provides no PoC, named exploit tool, active-exploitation claim, or remediation guidance.
10030283
405 followersView on X
yousukezan@yousukezan45d
Patch
cPanelは、EmailTrack機能のSQLインジェクション脆弱性「CVE-2026-67401」を公表した。認証済みアカウントから任意ファイルを作成でき、最終的にroot権限でコード実行につながる。 cPanelによると、攻撃にはメール関連権限を持つ有効なcPanelアカウントが必要だが、悪用するとデータベース内容の読み取り・変更や任意ファイル作成が可能になる。適切な場所へ悪性ファイルやスクリプトを書き込めれば、root権限でコマンドを実行できる。影響するのは各修正版より前のサポート対象cPanel/WHM。修正版はv11.110.0.143、v11.134.0.55、v11.136.0.39、v11.138.0.4で、WP2ではv11.138.1.9。 cPanelは速やかな更新を求めている。管理者には、メール関連権限を持つアカウントの確認、不要な権限の削除、EmailTrack利用履歴や不審なファイル書き込みの調査も推奨している。 https://gbhackers.com/cpanel-emailtrack-sql-injection-flaw/
Post summary
cPanel has publicly disclosed a SQL injection flaw (CVE‑2026‑67401) in its EmailTrack feature that allows authenticated users with email privileges to create files and potentially execute root‑level commands. Patch versions are listed and admins are urged to update immediately.
000211.2K
16.5K followersView on X
The CyberSec Guru@thecybersecguru45d
Disclosure
🚨 CRITICAL cPanel 0-day-style vulnerability: CVE-2026-67401 A normal authenticated cPanel account with mail privileges can abuse the EmailTrack SQL injection to create arbitrary files on the server. And the scary part? ➡️ Arbitrary file creation ➡️ Code execution ➡️ ROOT ACCESS ➡️ Full server takeover All supported cPanel versions are affected. If you run cPanel/WHM, check your build and PATCH NOW. 🔥 Full breakdown + affected versions + detection steps 👇 https://thecybersecguru.com/news/cve-2026-67401-cpanel-emailtrack/ #CyberSecurity #cPanel #CVE202667401 #InfoSec #RCE #SQLInjection
Post summary
The post announces CVE‑2026‑67401, a critical SQL injection in cPanel’s EmailTrack that allows authenticated users with mail privileges to execute arbitrary code and gain root access, and urges immediate patching of affected versions.
00020178
1.6K followersView on X
Autumn Good@autumn_good_3545d
Disclosure
『Successful exploitation leads to code execution as the root user, giving an attacker full control of the server.』 Security: CVE-2026-67401 SQL Injection Vulnerability in cPanel's EmailTrack Functionality - September 8, 2026 https://support.cpanel.net/hc/en-us/articles/43187903921559-Security-CVE-2026-67401-SQL-Injection-Vulnerability-in-cPanel-s-EmailTrack-Functionality-September-8-2026
Post summary
The announcement identifies CVE‑2026‑67401 as a SQL injection vulnerability in cPanel’s EmailTrack function that enables root-level code execution, with no mention of PoC, active exploitation, or patches.
00020543
7.3K followersView on X
Cybersecurity News Everyday@TweetThreatNews46d
Patch
cPanel patched CVE-2026-67401 in EmailTrack, where a mail-privileged account could create files and potentially escalate to root on affected servers. Fixed builds are available across supported release lines. #cPanel #WHM #CVE202667401 https://www.hendryadrian.com/new-cpanel-flaw-lets-a-hosting-account-with-mail-privileges-run-code-as-root/
Post summary
cPanel has released patches for CVE‑2026‑67401, addressing a privilege‑escalation flaw that allowed mail‑privileged accounts to create files and potentially gain root access.
00020286
4.9K followersView on X
kokumօtօ@__kokumoto46d
Patch
【また君か】cPanelにサーバ乗っ取りの脆弱性。CVE-2026-67401はSQLインジェクションで、メール関連の権限を持つ認証済みのcPanelアカウント所有者が、cPanelのEmailTrack機能を通じ、サーバー上に任意のファイルを作成可能なもの。root権限でのコード実行が可能。修正済み。 https://securityonline.info/cve-2026-67401-cpanel-sql-injection-flaw/
Post summary
A SQL injection flaw (CVE‑2026‑67401) in cPanel’s EmailTrack allows authenticated users to create arbitrary files and gain root execution; the vulnerability has been fixed.
00020859
7.8K followersView on X
ExploitGrid@exploitgrid16d
PoC
💀 CRITICAL Exploits Trending ├ CVE-2025-55182 · Meta/React “React2Shell” · PoC live (10) ├ CVE-2026-67401 · WebPros · PoC live (9.9) ├ CVE-2017-5638 · Apache Struts · PoC live (9.8)
Post summary
The post lists three CVEs and states that a PoC is live for each. It provides no exploit code, active-exploitation claim, remediation, or technical vulnerability details.
1000051
403 followersView on X
ExploitGrid@exploitgrid16d
Exploit
[EXPLOIT] CVE-2026-67401 [CRITICAL/PoC] CVSS: 9.9 | Vendor: #WebPros CVE-2026-67401 🔗 https://exploitgrid.net/exploits/b275bcfd-9254-493d-b237-fd56f2b069e7
Post summary
The post labels CVE-2026-67401 as a critical exploit/PoC and links to an exploit page, with a stated CVSS score of 9.9. It does not report active exploitation or mention remediation.
1000055
403 followersView on X
HostingDiscussion@HDforum24d
Patch
cPanel patched its third root-access vulnerability in six weeks (CVE-2026-67401), letting a basic hosting account escalate to full server control. Update now if you run cPanel or WHM. #cPanel #CyberSecurity #WebHosting #ServerSecurity https://t.co/NYxSThny0F
Post summary
cPanel has patched a root-access vulnerability (CVE-2026-67401) that allows privilege escalation, and users are urged to update immediately. The text emphasizes the importance of applying the patch rather than discussing exploits or active attacks.
1000035
359 followersView on X
CCB Alert@CCBalert43d
Disclosure
Warning: Critical SQL injection and OS command injection flaws in #cPanel WHM and #CSF allow root remote code execution. #RCE CVE-2026-67401 CVSS:9.9 CVE-2026-65639 CVSS:9.5 CVE-2026-65638 CVSS:9.2. Read our advisory: https://ccb.belgium.be/advisories/warning-multiple-critical-vulnerabilities-cpanel-whm-and-configserver-security-firewall and #Patch #Patch #Patch
Post summary
The tweet announces critical SQL injection and OS command injection flaws in cPanel WHM and CSF that enable root remote code execution, and references an advisory providing patch guidance.
00001316
7.2K followersView on X
セキュリティ対策Lab@securityLab_jp45d
Disclosure
cPanel & WHMのEmailTrackにSQLインジェクション脆弱性「CVE-2026-67401」、root権限でコード実行のおそれ https://rocket-boys.co.jp/security-measures-lab/cpanel-emailtrack-cve-2026-67401-issue/ #セキュリティ対策Lab #security #securitynews #セキュリティ
Post summary
A new SQL injection vulnerability (CVE-2026-67401) in cPanel & WHM’s EmailTrack has been disclosed, potentially allowing root‑level code execution, but no PoC, exploit, patch, or active exploitation is mentioned.
00010208
645 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-67401

Ryx[verified]@PadhiyarRushiPoC

CVE-2026-67401 is a cPanel privilege-boundary bug enabling authenticated users with mail privileges to achieve root RCE via EmailTrack abuse and arbitrary file writing; a public lab repo has published the exploitation chain, and fixed builds are available.

Rıdvan Yağlı[verified]@ridvanyagliPatch

The post announces a critical SQL injection in cPanel’s EmailTrack that can grant root execution to an authenticated user, and notes that security patches are available.

ZoomEye[verified]@zoomeye_teamDisclosure

The text announces a critical cPanel EmailTrack SQL injection vulnerability (CVE-2026-67401) with root RCE impact and provides exposure/target search details, but lacks PoC, exploit, patch, active exploitation, or false-positive indicators.

ZoomEye[verified]@zoomeye_teamDisclosure

The tweet announces CVE-2026-67401 as a critical cPanel SQL injection enabling remote code execution, provides ZoomEye search guidance for identifying exposed instances, but contains no evidence of active exploitation, PoC code, named exploit tools, or available patches.

Netlas.io[verified]@Netlas_ioDisclosure

The post discloses a SQL injection flaw in cPanel’s EmailTrack component that allows a privileged user to create files and potentially execute code as root. No PoC, exploit, patch, or active exploitation information is provided.

Hüseyin Mert[verified]@hmertGeneral

The tweet references CVE-2026-67401, a SQL injection in cPanel’s EmailTrack that could lead to root access, but offers no PoC, exploit code, active exploitation evidence, or patch details.

Rıdvan Yağlı[verified]@ridvanyagliExploit

CVE‑2026‑67401, a SQL injection in cPanel/WHM EmailTrack that can lead to root RCE, now has a publicly available PoC/exploit posted on GitHub, prompting users to update their cPanel versions immediately.

Misbar | مسبار[verified]@MisbarSecPatch

cPanel disclosed a critical SQL injection flaw (CVE‑2026‑67401) in EmailTrack that lets authenticated users gain root access. cPanel advises immediate patching and monitoring of suspicious activity.