EUVD-2026-75062
GHSA-cm73-4w66-phhj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain mail-enabled cPanel account
-
DeliverySend crafted input to EmailTrack
-
ExploitTrigger SQL injection in backend query
-
ExecutionEscalate to command execution as root
-
ImpactFull server and tenant compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated mail-enabled cPanel account (CVSS PR:L) that can reach the EmailTrack functionality over the network; no user interaction and no administrative privileges are needed. The limiting factor is possession of a valid mailbox on the target server - trivially met on shared/multi-tenant hosting where mail accounts are freely provisioned, but a real barrier on locked-down single-tenant installations. The affected server must be running a cPanel build below the patched versions (11.110.0.143 / 11.134.0.55 / 11.136.0.39 / 11.138.0.4 / 11.138.1.9). |
| Impact | The CVSS 3.0 vector CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H yields 9.9, driven by network reach, low complexity, only low privileges (a mail account is trivial to obtain on a hosting server), no user interaction, scope change, and total confidentiality/integrity/availability loss - a genuine top-priority issue given cPanel's role as a multi-tenant hosting platform. Reporting via HackerOne and a vendor security bulletin confirms the flaw is real and patched. EPSS, KEV, and SSVC data were not provided: this is not in CISA KEV (no confirmed active exploitation) and no public exploit code is identified, so realistic current risk is high-but-not-yet-mass-exploited. The one caveat: PR:L requires possessing a mail-enabled account, which on shared hosting is a low bar but on a single-tenant deployment meaningfully limits the attacker population. |
| Exploit ScenarioDerived | An attacker signs up for or compromises an ordinary email account on a shared cPanel hosting server, then sends crafted input to the EmailTrack functionality that injects SQL into a backend query. The injection is escalated into command execution in the root context, and the attacker takes full control of the host - reading all tenants' data, modifying sites, and pivoting further. No public POC is currently available, but the low attack complexity makes weaponization plausible once details spread. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 09, 2026
Root-level remote code execution in WebPros cPanel is achievable by any mail-enabled account through a SQL injection flaw in the EmailTrack component. An authenticated low-privilege mailbox user can chain the injection into command execution as root, giving full server takeover; the vendor has shipped fixes across five maintenance branches and a HackerOne-sourced report confirms the issue, though no public exploit has been identified at time of analysis.
RemediationAI
Apply the vendor-released patches: upgrade to cPanel 11.110.0.143, 11.134.0.55, 11.136.0.39, 11.138.0.4, or 11.138.1.9 (or later) matching your current release branch, per the cPanel security advisory dated September 8, 2026 (https://support.cpanel.net/hc/en-us/articles/43187903921559-Security-CVE-2026-67401-SQL-Injection-Vulnerability-in-cPanel-s-EmailTrack-Functionality-September-8-2026). cPanel's automatic update mechanism (upcp) should pull the fixed build; verify the running version afterward. If patching must be delayed, reduce exposure by restricting who can create/hold mail-enabled accounts and by limiting network access to the cPanel/webmail interfaces to trusted networks, accepting that this degrades legitimate remote mail management; auditing EmailTrack access logs for anomalous queries is a detection-oriented compensating control but does not prevent exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
cPanel is a Linux web-hosting control panel (CPE cpe:2.3:a:webpros:cpanel) that manages email, DNS, databases, and account provisioning for shared and dedicated hosting. The root cause is CWE-89 (SQL Injection) in the EmailTrack email-delivery-tracking functionality, where attacker-influenced input reaches a database query without adequate parameterization. Because cPanel's backend runs privileged daemons, the injection is leveraged beyond data access into command execution in the root context, reflected by the CVSS scope change (S:C) where the exploited component (the mail-account privilege boundary) differs from the impacted component (the underlying host as root).
Know when Cpanel gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable, low-complexity SQLi needs only a low-privilege mail account (PR:L); escalation to root escapes the account's privilege boundary (S:C) with full C/I/A loss.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component
Technical POC Analysis
The assigned bug class is CWE-89, SQL injection.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 public PoC link from packetstorm
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
WebPros cPanel deployments are vulnerable to complete server takeover through SQL injection in the EmailTrack component, exploitable by any authenticated mail-enabled account. This threatens any organization using cPanel for email or web services. Vendor-released patches are available and no public exploit has been identified at time of analysis, but the critical severity (CVSS 9.9) demands immediate patching to prevent potential infrastructure compromise.
Apply vendor patch
Threat Model
5 threats: Elevation of Privilege, Tampering, Information Disclosure and 1 more
4-step attack chain with trust boundaries and controls
Full threat model - attack chain, trust boundaries, controls per stage and evidence - is part of the Pro and Business plans.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
An issue was discovered in cPanel before 11.109.9999.116. Rated medium severity (CVSS 6.1), this vulnerability is remote
cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is
OS command injection in cPanel and WP Squared allows an authenticated, low-privileged hosting account holder to execute
OS command injection in the AUTOM8N plugin for WHM/cPanel (all versions through commit 82821f7) allows an attacker who c
cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488). Rated critical severit
In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554). Rated critical severit
In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549). Rated critical severit
chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497). Rated critical severity (CVSS 9.8), this vulnerability
cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution (SEC-485). Rated critical severit
cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs (SEC-546). Rated critical s
cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell (SEC-544). Rated c
Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows a remote authenticated (low-privileged, PR:L
Exploit-DB