No fixed build or workaround is published yet. Limit exposure and watch for a patch.
Steps
Written by AI from the record
Check whether your cPanel version is older than any of the fixed releases (11.134.0.55, 11.136.0.39, 11.138.0.4, 11.138.1.9, 11.110.0.143) and confirm the EmailTrack component is enabled.
Identify all mail-enabled accounts on the cPanel host (mail users) that can access email tracking.
Upgrade cPanel to the appropriate fixed version from your current branch immediately: 11.134.0.55, 11.136.0.39, 11.138.0.4, 11.138.1.9, or 11.110.0.143.
If upgrading takes time, temporarily reduce risk by disabling EmailTrack (email tracking) for affected accounts/hosts until you can patch.
After patching, review logs for unusual EmailTrack/database-related activity and verify no unauthorized changes were made to system files.
A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component
In plain language
Written by AI from the record
If you run cPanel with its EmailTrack (email tracking) feature enabled, a basic email account on the server could use it to run commands as the server’s administrator (root). Small businesses should treat this as urgent if you use email-enabled cPanel accounts, because the attack does not require tricking a user or clicking anything.
In cPanel, the EmailTrack component has a SQL injection flaw (CWE-89) that lets a mail-enabled account send crafted tracking data to trigger remote code execution as root; this requires only low-level credentials (a valid mail-enabled account) and no user interaction.
If you're affected
Full server takeover as root
Website and customer data theft
Malware installation / persistence
Complete service disruption
What is it
Think of cPanel’s EmailTrack like a mail “receipt” system that records or tracks activity. This bug lets a malicious user with a normal mail account send specially crafted data that tricks cPanel into running commands on the server as root. That’s like giving an attacker who only has a regular mailbox the ability to take total control of the whole server.
Who is affected
This matters if you run cPanel on a server that has EmailTrack (email tracking) enabled and you have mail-enabled accounts (mail users) on that server. The danger is highest when an attacker already has access to a valid mail account on the same cPanel host, because the issue relies on low-level authentication and doesn’t require the attacker to trick anyone into clicking or interacting. If EmailTrack is not reachable/disabled for mail users, the risk is reduced; if it is enabled and mail users exist on the affected version, treat it as reachable.
How urgent is it
This is RED because it allows remote code execution as root through SQL injection in the EmailTrack component, and it can be triggered by an attacker who already has a basic mail account on the server. There is no need for user clicks or other interaction, which makes it straightforward to attempt. Even though there is no confirmed CVE-specific exploitation report in the provided findings, the impact is full administrative control, so you should patch immediately.
What to do — in detail
Confirm exposure
In your cPanel server, record the exact cPanel version.
Check whether the EmailTrack (email tracking) component/feature is enabled for mail-enabled accounts.
Confirm whether you have any mail users on this server that can use email tracking.
Determine the fixed upgrade target
Upgrade cPanel to the fixed release that applies to your update branch:
11.134.0.55
11.136.0.39
11.138.0.4
11.138.1.9
11.110.0.143
Upgrade guidance
Apply the upgrade as soon as possible using your standard cPanel update process.
After upgrade, re-verify:
cPanel reports the new version.
EmailTrack is still enabled if you require it.
Temporary workaround (if patching cannot be immediate)
Disable/turn off EmailTrack (email tracking) for the affected cPanel host (or for mail users, if you can scope the setting).
Keep it disabled until you finish upgrading to one of the fixed versions listed above.
Post-upgrade checks
Review the cPanel and system logs for unusual EmailTrack activity and any database-related errors or unexpected process executions.
Look for signs of persistence (new scheduled tasks, unexpected binaries/scripts, or modified system files), especially if you notice suspicious log entries.
Monitoring going forward
Watch for continued abnormal EmailTrack/database patterns after the upgrade.
If you have many cPanel hosts, prioritize those with the highest number of mail-enabled accounts.
Technical context
Severity is critical in practice because the issue is remote code execution as root. The weakness is SQL injection (CWE-89) in cPanel’s EmailTrack component, where crafted inputs from a mail-enabled account can manipulate database requests to reach command execution.
Attack prerequisites from the findings:
Network-accessible attack surface.
Low authentication requirement: the attacker must have valid access to a basic email (mail-enabled) account that can reach the EmailTrack component.
No user interaction required.
Exploitation status:
No KEV listing in CISA KEV.
No public exploit code on record in the findings.
No CVE-2026-67401–specific exploitation incident is reported in the provided news findings (though a different cPanel flaw was mentioned as exploited elsewhere).
Patch status:
Fixed in cPanel versions: 11.134.0.55, 11.136.0.39, 11.138.0.4, 11.138.1.9, and 11.110.0.143.
What KEV absence means here:
KEV not listed means this vulnerability is not confirmed in the KEV program based on the provided findings; however, due to the root-level impact and straightforward prerequisites, it should still be treated as an urgent patch.
This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.
