CVE-2026-67401: WebPros cPanel vulnerability
Advisory generated from the CVE record, CISA, Exploit Observer and VEDAS: what it is, whether it is exploited, who is affected, and how to fix and detect it.
Generated by VEDAS. Scores as of 2026-11-08 00:03 UTC. Rebuilt every few hours from cve-scores, CISA KEV and vedas-signatures. How this works and its limits.
What it is
A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component
Description quoted from the CVE record (assigned by hackerone, published 2026-09-09).
Weakness: CWE-89 SQL Injection
How it can be exploited
Exploitable over the network with low attack complexity needing low privileges and no user interaction. Impact: confidentiality high, integrity high, availability high. CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA assessment (SSVC): CISA has no evidence of exploitation. Automatable: no. Technical impact: total.
Public exploit evidence (Exploit Observer)
Exploit Observer found 7 code repositories and 1 research write-up naming this CVE.
Code repositories that name a CVE are often scanners, copies or fakes, and some are malware. Read the code before running anything.
See all 11 references on Exploit Observer
Live scores
- EPSS
- 0.009
low predicted chance of attack - VEDAS
- 0.973
strong exploit evidence - On CISA KEV
- Not listed
- Detection rule
- Suricata
Who is affected
| Product | Affected | Not affected |
|---|---|---|
| WebPros cPanel | before 11.134.0.55 before 11.136.0.39 before 11.138.0.4 before 11.138.1.9 before 11.110.0.143 | Not stated |
Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.
How to fix it
Fixed versions stated in the CVE record: 11.134.0.55, 11.136.0.39, 11.138.0.4, 11.138.1.9, 11.110.0.143.
How to detect it
Suricata rules (network detection)
1 rule that alert on traffic matching this exploit: VEDAS CVE-2026-67401 cPanel EmailTrack - SQL Injection via account. Add them to your Suricata rule set and reload.
Show the rules
alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"VEDAS CVE-2026-67401 cPanel EmailTrack - SQL Injection via account"; flow:established,to_server; http.uri; content:"EmailTrack"; nocase; fast_pattern; content:"account"; nocase; pcre:"/account[\x22\x27]?\s*[:=]\s*[\x22\x27]?[^&\x22\x27]*(?:\x27|\x22|\sunion\s|\sselect\s|into\s+outfile|into\s+dumpfile|load_file\x28|sleep\x28|benchmark\x28|information_schema|\x2d\x2d|\x23|\x2f\x2a)/i"; classtype:web-application-attack; reference:cve,CVE-2026-67401; reference:url,https://www.exploit.observer/?keyword=CVE-2026-67401&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=cpanel&match=exact; sid:1104411; rev:1;)
CVE-2026-67401.rules on GitHub
References
Other references
Other databases
Where this comes from
This advisory is generated automatically by VEDAS from: CVE.org record, cve-scores (EPSS and VEDAS), Exploit Observer, vedas-signatures. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.
Supporting partners
