## https://sploitus.com/exploit?id=C2DC4E64-B910-5B86-8BFD-1D410F8EE5B7
# CVE-2026-67401 — cPanel & WHM EmailTrack SQL Injection → Root RCE
**IOC Scanner, Detection Toolkit & Remediation Guide for the cPanel EmailTrack SQL Injection Vulnerability**
> **Keywords:** CVE-2026-67401, cPanel exploit, cPanel SQL injection, WHM vulnerability, EmailTrack SQLi, cPanel root RCE, cPanel IOC scanner, cPanel compromise assessment, WHM security advisory, cPanel patch 2026, cPanel & WHM security update, web hosting vulnerability, cPanel privilege escalation, mail-enabled cPanel account exploit, cPanel arbitrary file creation, shared hosting takeover, cPanel incident response, cPanel forensics script, cPanel hardening guide.
---
## ⚠️ Important Notice — Read Before Using This Repository
As of the last update to this repository, **CVE-2026-67401 is a newly-assigned CVE with no publicly confirmed technical write-up, no published exploitation primitives, and no known public proof-of-concept**. cPanel/WebPros discloses full technical detail for its vulnerabilities only *after* a Technical Security Release (TSR) ships, specifically to prevent pre-patch exploitation — so authoritative low-level detail (exact injection point, exact patched build numbers) may not yet be publicly available at the time you are reading this.
**This repository intentionally does NOT contain a working SQL injection payload or exploit chain.** It focuses on what defenders actually need on day zero of a disclosure:
- Version/patch-level fingerprinting
- Indicator-of-Compromise (IOC) scanning based on the disclosed *impact* of the bug (unauthorized file creation, SQL injection through the EmailTrack feature, root-level code execution)
- Log and file-integrity triage
- Hardening and mitigation guidance
If/when cPanel publishes the full advisory and a patched build number, update `PATCHED_BUILD` in `scripts/cve-2026-67401-ioc-scan.sh` and re-run the scanner fleet-wide.
---
## 1. Vulnerability Summary
| Field | Detail |
|---|---|
| **CVE ID** | CVE-2026-67401 |
| **Component** | cPanel & WHM — *EmailTrack* (email delivery tracking) feature |
| **Vulnerability Class** | SQL Injection (CWE-89) → Arbitrary File Creation → Remote Code Execution as `root` |
| **Attack Vector** | Network (authenticated) |
| **Privileges Required** | Low — a valid cPanel account with **mail-related privileges** (not a WHM/root account) |
| **User Interaction** | None |
| **Impact** | Full server compromise — code execution as `root` |
| **Public Exploitation** | None confirmed as of publication |
| **Public PoC** | None known as of publication |
| **Affected Products** | cPanel & WHM (all currently supported versions prior to the fixed builds); WP Squared deployments layered on affected cPanel builds may also be impacted |
### Plain-English Description
CVE-2026-67401 is a **SQL injection vulnerability in cPanel & WHM's EmailTrack functionality** — the subsystem that logs and reports on outbound/inbound email delivery. According to the vendor advisory summary reported by security researchers, an **authenticated cPanel account holder who has mail-related privileges** (i.e., any ordinary hosting customer with email enabled — not an administrator) can supply crafted input that is unsafely concatenated into a SQL query executed by EmailTrack's backend.
Because the resulting SQL injection allows the attacker to manipulate backend database operations, it can be abused to **create arbitrary files on the server**. Since certain EmailTrack/cPanel database and file-writing operations run in a privileged context, the attacker-controlled file write can be leveraged to achieve **code execution as the `root` user** — turning a low-privilege hosting account into a full root compromise of the shared server.
This pattern (SQLi → `INTO OUTFILE`-style arbitrary file write → privileged code execution) is a classic "SQLi-to-RCE" escalation chain and is especially severe on **shared hosting environments**, where hundreds or thousands of unrelated customer accounts run on the same physical/virtual host — meaning a single low-privilege, mail-enabled customer account anywhere on the box is enough to compromise every tenant on that server.
### Why This Matters
- cPanel & WHM powers a very large share of the web hosting industry — estimates commonly cited by researchers put usage in the **millions of servers / tens of millions of domains**.
- The bug requires only a **low-privilege, mail-enabled cPanel account** — the kind sold to ordinary customers on shared/reseller hosting — not a WHM or root account. This dramatically lowers the bar for exploitation on multi-tenant hosts (malicious "customer," compromised low-value customer account, etc.).
- The end state is **root on the box**, meaning every other tenant, every database, every mailbox, and the hosting provider's control-plane trust boundary is at risk.
- Shared hosting compromises of this type have historically been used for **mass web-shell deployment, ransomware staging, credential theft, and further pivoting** into hosting-provider infrastructure.
---
## 2. Affected Versions & Patch Status
> cPanel ships fixes through **Technical Security Releases (TSRs)**. Exact build numbers for CVE-2026-67401 should be confirmed against the **official cPanel security advisory** before you rely on any number here — vendor-published build numbers are the only authoritative source.
| Track | Status |
|---|---|
| cPanel & WHM — all currently supported version tiers prior to the fix | **Vulnerable** |
| cPanel & WHM — patched builds (per vendor TSR) | **Fixed** |
| WP Squared deployments running an affected cPanel build | **Potentially vulnerable** |
| End-of-life (EOL) cPanel & WHM branches | **Likely vulnerable / no fix planned** — upgrade to a supported major version |
**Action:** Check your installed build with:
```bash
/usr/local/cpanel/cpanel -V
```
...and compare it against the fixed build listed on cPanel's official security advisories page (linked below). This repo's scanner (`scripts/cve-2026-67401-ioc-scan.sh`) automates this check — just fill in the patched build number once cPanel publishes it.
---
## 3. Quick Start — Run the IOC Scanner
```bash
git clone https://github.com//CVE-2026-67401-cPanel-EmailTrack-SQLi.git
cd CVE-2026-67401-cPanel-EmailTrack-SQLi
chmod +x scripts/cve-2026-67401-ioc-scan.sh
# Run as root on the WHM/cPanel server itself
sudo ./scripts/cve-2026-67401-ioc-scan.sh
```
The scanner is **read-only** — it does not modify configuration, does not attempt exploitation, and does not require internet access. It writes a timestamped report to `/root/cve-2026-67401-ioc-report-.txt` (and JSON if `jq` is available).
See [`docs/DETECTION.md`](docs/DETECTION.md) for what each check does and how to interpret results, and [`docs/REMEDIATION.md`](docs/REMEDIATION.md) for patching and hardening steps.
---
## 4. What the Scanner Checks
1. **Version/patch-level fingerprinting** — installed cPanel & WHM build vs. known-vulnerable/patched ranges (configurable).
2. **cPanel RPM/package integrity** — `rpm -Va`-style verification to flag unexpected modifications to cPanel binaries and Perl/CGI modules.
3. **Suspicious newly-created root-owned files** — scans common web/mail-writable paths for recently created files owned by `root` (the disclosed impact of this bug is unauthorized arbitrary file creation).
4. **MySQL/MariaDB log triage** — if the general/slow query log is enabled, greps for classic SQLi and file-write markers (`INTO OUTFILE`, `INTO DUMPFILE`, `UNION SELECT`, `LOAD_FILE`, stacked queries) in proximity to EmailTrack-related tables/queries.
5. **cPanel/Exim/Apache log triage** — flags unusual request patterns to email-tracking-related endpoints and unexpected 5xx/500 spikes that can correlate with injection attempts.
6. **Unexpected privileged processes / cron / SUID changes** — a generic "did something escalate to root recently" sweep, useful for any SQLi→RCE-class bug, not just this one.
7. **New/unexpected WHM & cPanel accounts, and accounts with unexpected mail privileges.**
> These are **general-purpose compromise-assessment heuristics** built around the *publicly disclosed impact* of the bug (arbitrary file creation via SQL injection in EmailTrack, escalating to root). They are not a guarantee of detection or non-detection — treat a clean scan as "no obvious indicators found," not as proof the host is unaffected.
---
## 5. Remediation Priority Order
1. **Patch immediately.** Update cPanel & WHM to the fixed build referenced in the official advisory (`WHM ≫ Software ≫ Update Preferences` or `/scripts/upcp` from the CLI).
2. **If you cannot patch immediately:** restrict which accounts have mail-related privileges, and consider firewalling the WHM/cPanel management ports (2082/2083/2086/2087) from untrusted networks.
3. **Audit** all mail-enabled accounts on affected hosts — this bug is exploitable by any account with mail privileges, so treat every hosting customer as a potential (even unwitting/compromised) attacker vector until patched.
4. **Run the IOC scanner** in this repo on every host that was running a vulnerable build, even after patching, to rule out pre-patch compromise.
5. **Rotate credentials and re-image if IOCs are found** — SQLi-to-root chains are commonly followed by persistence (web shells, cron backdoors, SSH keys, new WHM accounts). A patch alone does not remove an existing backdoor.
Full details: [`docs/REMEDIATION.md`](docs/REMEDIATION.md)
---
## 6. Repository Structure
```
CVE-2026-67401-cPanel-EmailTrack-SQLi/
├── README.md # This file
├── LICENSE
├── CHANGELOG.md
├── scripts/
│ └── cve-2026-67401-ioc-scan.sh # Main IOC / compromise-assessment scanner
├── docs/
│ ├── DETECTION.md # Detailed explanation of every IOC check
│ ├── REMEDIATION.md # Patch + hardening + incident-response steps
│ └── TIMELINE.md # Disclosure timeline & source log
└── .github/ISSUE_TEMPLATE/
└── ioc-report.md # Template for reporting new IOCs/false positives
```
---
## 7. Timeline
| Date | Event |
|---|---|
| 2026-09-09 | Vulnerability publicly reported by security media; CVE-2026-67401 assigned. No public PoC or confirmed in-the-wild exploitation at time of reporting. |
| TBD | cPanel official TSR / patched build publication |
| TBD | This repository's `PATCHED_BUILD` variable updated |
Full source-by-source timeline: [`docs/TIMELINE.md`](docs/TIMELINE.md)
---
## 8. References
- cPanel Official Security Advisories: https://sec.cpanel.net/
- cPanel & WHM Documentation: https://docs.cpanel.net/
- MITRE CVE Record (check for current status): https://vulners.com/cve/CVE-2026-67401
- NVD Record (check for current status): https://nvd.nist.gov/vuln/detail/CVE-2026-67401
- Daily CyberSecurity, "CVE-2026-67401: cPanel Flaw Grants Full Control of the Server" — https://securityonline.info/cve-2026-67401-cpanel-sql-injection-flaw/
> ⚠️ At time of writing, this CVE had not yet appeared in NVD's public database with full metadata — check the MITRE/NVD links above for the current authoritative status before acting on any specifics in this repo.
---
## 9. Disclaimer & Legal
This repository is published **for defensive purposes only** — patch verification, compromise assessment, and incident response on infrastructure you own or are authorized to test. It contains **no exploit code, no SQL injection payloads, and no working proof-of-concept** for CVE-2026-67401.
Unauthorized access to computer systems is illegal in most jurisdictions (e.g., the U.S. Computer Fraud and Abuse Act, the UK Computer Misuse Act, and equivalent laws elsewhere). Only run the tooling in this repository against systems you own or are explicitly authorized to assess.
## 10. Contributing
Corrections, updated patched-build numbers, additional IOC signatures, and false-positive reports are welcome — open an issue using the template in `.github/ISSUE_TEMPLATE/ioc-report.md` or submit a pull request. Please cite sources for any technical claims.
## License
MIT — see [`LICENSE`](LICENSE).