Project
cPanel & WHM is a widely used web hosting control panel suite for managing servers, websites, email, and hosting accounts.
CVE-2026-67401 lets an ordinary cPanel mail account escalate to root through a SQL injection in the EmailTrack delivery-log feature. cPanel disclosed the vulnerability class but has not published the vulnerable parameter or the query behind it.
Reality
Canada's Cyber Centre says attackers are exploiting CVE-2026-48842, a no-login SQL injection in Roundcube's virtuser_query plugin rated 8.1. Only unpatched servers running that plugin are exposed, and Shadowserver flags 10 vulnerable hosts out of more than 523,000 online.
Perspective Coverage
4 publishersReality
cPanel's September 14 advisory covers every LiteSpeed Web Server Enterprise build before 6.3.7. The fix shipped on September 11; because auto-update may lag, administrators have to force it onto servers by hand.
Reality
cPanel says every supported build of cPanel and WHM is affected by CVE-2026-67401, and its September 8 advisory arrived without a severity score or any interim step for hosts that cannot take the upgrade yet.
Reality
cPanel shipped fixes for CVE-2026-65643 on August 27 across four build branches. Administrators checking their own build get no CVSS score, no published CVE record and nothing to grep for prior abuse.
Reality