Paper/Archive/CVE-2026-67401

CVE-2026-67401

WebPros cPanel — A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component

EPSS 0.9%CVSS 9.9

critical.is priorityof 100

CVSS 9.9 (CNA)9.9 / 10 × 3029.7 Not in CISA KEV+300.0 EPSS percentile 58.5.585 × 2011.7 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component

Affected

ProductAffectedFixed inSource

cPanel< 11.134.0.5511.134.0.55CNA

cPanel< 11.136.0.3911.136.0.39CNA

cPanel< 11.138.0.411.138.0.4CNA

cPanel< 11.138.1.911.138.1.9CNA

cPanel< 11.110.0.14311.110.0.143CNA

Scores by source

hackerone (CNA)9.9CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refsupport.cpanel.net/hc/en-us/articles/43187903921559-Security-CVE-2026-67401-SQL-Injection-Vulnerability-in-cPanel-s-EmailTrack-Functionality-September-8-2026