Why "Authenticated-Only" Bugs Are More Dangerous Than You Think (cPanel CVE-2026-67401)

Why "Authenticated-Only" Bugs Are More Dangerous Than You Think (cPanel CVE-2026-67401)

If your vulnerability triage process automatically ranks authenticated-access bugs below unauthenticated RCE, this disclosure is worth revisiting that assumption.

cPanel published an advisory on September 8, 2026 for CVE-2026-67401 — a SQL injection vulnerability in its EmailTrack module, the component that logs and displays email delivery activity. The CVE Program scored it 9.9 CVSS, and here's why the score is that high despite requiring authentication: the privilege bar to exploit it is almost nonexistent.

Any account with mail-related privileges — the default on nearly every basic shared hosting plan — can trigger the flaw. Unsanitized input reaches a database query, the attacker abuses that access to write arbitrary files to disk, and those files are ultimately leveraged to achieve code execution as root.

On a single-tenant server, that's bad. On shared hosting infrastructure running hundreds of unrelated customer sites per box, it collapses the entire trust boundary between tenants.

Affected: all supported cPanel/WHM builds below 11.110.0.143, 11.134.0.55, 11.136.0.39, 11.138.0.4, and WP2 11.138.1.9.

Quick version check:

/usr/local/cpanel/cpanel -V

If your build is below your tier's patched version, update now — cPanel's own advisory notes that network-level restrictions don't mitigate this since exploitation requires a legitimate login, not anonymous access.

Full writeup with the complete patch table, IOC hunting guidance, and a defense checklist for hosting/SOC teams:

https://www.xpert4cyber.com/2026/09/cpanel-cve-2026-67401-sql-injection.html