{"id":"CVE-2026-67401","title":"A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component","summary":"A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component","severity":"critical","cvss":9.9,"cvssVector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":["CWE-89"],"vendor":"WebPros","product":"cPanel","affected":["cPanel < 11.134.0.55","cPanel < 11.136.0.39","cPanel < 11.138.0.4","cPanel < 11.138.1.9","cPanel < 11.110.0.143"],"published":"2026-09-09","updated":"2026-09-10","sourceUpdated":"2026-09-10T04:18:04.630","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-67401","references":[{"url":"https://support.cpanel.net/hc/en-us/articles/43187903921559-Security-CVE-2026-67401-SQL-Injection-Vulnerability-in-cPanel-s-EmailTrack-Functionality-September-8-2026","label":"support@hackerone.com"}],"tags":["nvd","cve.org","exploit-available"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-09T00:00:00+00:00"},"ingestedAt":"2026-09-12T05:41:15.142Z","epss":0.0104,"epssPercentile":0.61976,"exploits":{"github":4,"githubRepos":["https://github.com/axedos/CVE-2026-67401","https://github.com/HORKimhab/CVE-2026-67401","https://github.com/jithinkrishnanrs/CVE-2026-67401-cPanel-EmailTrack-SQLi"],"checkedAt":"2026-09-21T15:30:12.621Z"},"exploitAvailable":true,"slug":"CVE-2026-67401","body":"## Overview\n\nA vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"abyssal","depthScore":67,"depthScoreParts":{"impact":54.5,"likelihood":0.2,"exploitation":12,"ransomware":0},"changes":[{"seq":66501,"id":"CVE-2026-67401","ts":1789096180219,"field":"exploit_available","old":"false","new":"true"},{"seq":24907,"id":"CVE-2026-67401","ts":1788985311339,"field":"exploit_available","old":"false","new":"true"},{"seq":20934,"id":"CVE-2026-67401","ts":1788974199724,"field":"exploit_available","old":"false","new":"true"}]}