CVE-2026-67401

A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component

Affected

WebPros · cPanel

CVSS v3.0 HACKERONE

9.9 CRITICALCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS

0.86% chance of exploitation in the next 30 days, 58th percentile

Published

2026-09-09

Updated

2026-09-10

Proof-of-concept exploits (4)

• axedos/CVE-2026-674013★ · 2026-09-09
• jithinkrishnanrs/CVE-2026-67401-cPanel-EmailTrack-SQLi0★ · 2026-09-13
• imbas007/CVE-2026-674015★ · 2026-09-17
• hitechcloud-vietnam/CVE-2026-674010★ · 2026-10-06

References

• CVE Record
• NVD entry

Related

• CVE-2022-36804
• CVE-2025-24813
• CVE-2025-25257
• CVE-2025-3248
• CVE-2025-40554
• CVE-2025-52970