What cPanel actually disclosed
The advisory is short, and worth reading exactly as written rather than as summarised by anyone, us included. cPanel says that an authenticated cPanel account holder with mail-related privileges can create arbitrary files on the server through the EmailTrack functionality, and that successful exploitation leads to code execution as the root user, giving an attacker full control of the server.
Note the shape of that sentence. It begins with something very ordinary, an email account, and ends with something total. The interesting part of this vulnerability is not the SQL injection itself. It is the distance the injection travels.
| Identifier | CVE-2026-67401 |
| Component | EmailTrack, in cPanel and WHM |
| Affected | All supported versions |
| Patched builds | v11.110.0.143, v11.134.0.55, v11.136.0.39, v11.138.0.4, WP2 v11.138.1.9 |
| Requires | An authenticated account with mail privileges |
| Ends in | Code execution as root |
Credit for responsible disclosure goes to Ali Mustafa (rz1027) and abed1526.
The distance from an email account to root
On a single-tenant server, needing an authenticated account is a real barrier. You control every account on the box, so the set of people who could start that chain is the set of people you already trust.
On shared or reseller hosting it is not a barrier at all. Every customer on the machine already holds an account with mail privileges. That is what they bought. So the question stops being "could an attacker get an account" and becomes "are all several hundred accounts on this server, and everyone who has ever reused one of those passwords elsewhere, trustworthy and uncompromised". One weak password on one unrelated site is the whole chain.
This is the part worth sitting with if you run a Magento store on shared hosting. Your store's security is not a function of your own diligence. It is a function of the least careful tenant on the same machine.
"All supported versions" means you too
Some advisories affect one release line, and most readers can scroll to the table, see a version they are not running, and move on. This is not one of those. The affected column reads "All supported versions", which means being current was no protection. Diligence did not exempt anyone here. Patching after the fact was the only option available.
That also means there is exactly one question that matters, and it is not whether your host takes security seriously in general. It is what build number your server is running right now. Everything else is atmosphere.
One honest observation. cPanel's advisory publishes no CVSS score and no severity rating, which is unusual for a bug whose stated impact is root code execution. We are not going to invent a number to fill the gap. Judge it on the advisory's own words: low-privilege access in, full control of the server out.
What we did, with timestamps
Every cPanel server we run was affected, because every supported version was affected. We are not going to dress that up. What matters is the gap between disclosure and remediation, so here is ours, measured rather than asserted.
All 11 EveryHost cPanel servers were running the patched build v11.136.0.39 on 8 September 2026, the same day the advisory went out. The first landed at 15:10 and the last at 17:01, a window of one hour and fifty one minutes. We then checked the running build on each server individually, because "the updater ran" and "the server is patched" are not the same claim.
If you are hosted somewhere else
Do this today rather than adding it to a list. If you have root, run:
/usr/local/cpanel/cpanel -VCompare the result against the patched build for your tier. A server on the 11.136 line needs build 39 or higher. If you cannot get a shell, WHM shows the running version on its home screen.
If you are on shared hosting, ask your host for the exact build number. Not "are we patched", which invites a reassuring yes. Ask them to tell you the number and the time it was applied. A host that can answer that in minutes is telling you something useful about how the next one will go. A host that cannot, or will not, is also telling you something useful.
Then look for what the bug actually does, which is create files. Anything unexpected and recently written under web-accessible paths deserves attention, which is the same instinct we wrote about when a genuine injection turned up during the StyleSmuggler sweep. And if you are heading into peak trading on a platform you are unsure about, the peak season security guide covers what to lock down before the code freeze.
Frequently Asked Questions
Source
cPanel security advisory, CVE-2026-67401 SQL Injection Vulnerability in cPanel's EmailTrack Functionality, published 8 September 2026. Patch times in this article were read from the running build on each of our servers on the same day.
Want a host that can tell you the build number?
EveryHost runs dedicated and managed Magento servers in the UK, patched by UK engineers who will give you a timestamp rather than a reassurance. Ask us anything about this CVE, including whether your current setup is exposed.