{"vulnerability": "CVE-2026-67401", "sightings": [{"uuid": "61e85b15-5699-4f2f-978f-f89f7d672ecd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67401", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mv2g6go54o2t", "content": "A critical CVE-2026-67401 cPanel SQL injection flaw in EmailTrack allows authenticated users to gain full control of the server. Patch your system today.\n\n#cPanel #SQLInjection #CVE202667401 #Cybersecurity #Vulnerability", "creation_timestamp": "2026-09-09T01:47:32.085895Z"}, {"uuid": "a9507dbb-46a2-4c26-855b-b622734955f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67401", "type": "seen", "source": "https://bsky.app/profile/uutis.bsky.social/post/3mv34etv6xs25", "content": "cPanelin EmailTrack-toiminnossa on paljastunut kriittinen SQL-injektio-haavoittuvuus (CVE-2026-67401), jonka avulla matalan oikeustason k\u00e4ytt\u00e4j\u00e4 voisi v\u00e4itetysti saada root-oikeudet. Haavoittuvuus koskee kaikkia tuettuja cPanel & WHM -versioita.\n\n#kyberturvallisuus", "creation_timestamp": "2026-09-09T08:24:51.125941Z"}, {"uuid": "ca49f5e6-3186-4bb5-80f6-abb92e81113f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67401", "type": "seen", "source": "https://bsky.app/profile/newsfacts.bsky.social/post/3mv36f6ilyv25", "content": "CPanel kwetsbaarheid opent de deur naar root-toegang en data-diefstal.\n\ncPanel heeft op 8 september 2026 een kritieke kwetsbaarheid met de naam CVE-2026-67401 openbaar gemaakt. Deze SQL-injectiekwetsbaarheid bevindt zich in de EmailTrack-functionaliteit van het platform. EmailTrack...", "creation_timestamp": "2026-09-09T09:00:51.559471Z"}, {"uuid": "76483621-7395-4e7e-b97c-c3c6d6470e1b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67401", "type": "seen", "source": "https://bsky.app/profile/abijita.bsky.social/post/3mv3asm62zi2w", "content": "cPanel Fixes Critical Flaw That Could Give Attackers Root\u00a0Access\n\ncPanel has patched CVE-2026-67401, a security flaw that could allow an authenticated hosting account to create files and execute code as root on affected servers.", "creation_timestamp": "2026-09-09T09:44:07.233037Z"}, {"uuid": "ec2848a3-68cc-4a5a-8c28-e533e67168ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67401", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mv3bpwk5su2l", "content": "cPanel patched CVE-2026-67401 in EmailTrack, where a mail-privileged account could create files and potentially escalate to root on affected servers. Fixed builds are available across supported release lines. #cPanel #WHM #CVE202667401", "creation_timestamp": "2026-09-09T10:00:30.453990Z"}, {"uuid": "6754812b-4eac-4a79-8561-56dd0ef8a809", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67401", "type": "seen", "source": "Telegram/j0PsdiAJ2pcbJR995Thb3rfk0dWAfkhfh9U9VXIxLqzuXI0", "content": "", "creation_timestamp": "2026-09-09T12:00:04.260501Z"}, {"uuid": "1bebc421-4685-4415-9be6-8bf2051bc49a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67401", "type": "seen", "source": "https://t.me/thehackernews/10009", "content": "\u203c\ufe0fWarning: New CVE-2026-67401 vulnerability in cPanel lets mail-privileged hosting accounts execute code as root.\n\ncPanel says every supported cPanel & WHM version is affected and has released fixed builds.\n\nRead details here: https://thehackernews.com/2026/09/new-cpanel-flaw-lets-hosting-account.html", "creation_timestamp": "2026-09-09T12:00:04.451895Z"}, {"uuid": "4a9bc062-cac7-491e-bccd-c78f8d14d0e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67401", "type": "seen", "source": "https://t.me/GithubRedTeam/101805", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-67401\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a axedos\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-09 10:46:53\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\npoc in python for CVE-2026-67401\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-09T13:00:04.091336Z"}, {"uuid": "b77c146b-7779-41cf-9448-186f7d261c83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-67401", "type": "seen", "source": "https://bsky.app/profile/thecybersecguru.com/post/3mv3mmnu6562e", "content": "Critical cPanel Vulnerability (CVE-2026-67401): How an EmailTrack SQL Injection Grants Root\u00a0Access\n\nA critical cPanel EmailTrack SQL injection vulnerability, CVE-2026-67401, can allow authenticated attackers to escalate to root and\u2026\n\nhttps://thecybersecguru.com/news/cve-2026-67401-cpanel-emailtrack/", "creation_timestamp": "2026-09-09T13:15:31.959273Z"}, {"uuid": "d8b9fe20-bbe8-4be2-af63-6d6e28735c3c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67401", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mv44rm3elk2c", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-67401: A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component\nCVSS 9.9\nhttps://beta.vulnsea.com/cve/CVE-2026-67401\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-09T18:04:36.659879Z"}, {"uuid": "74b2114f-bbbf-4717-a9b6-cb720f7e63fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-67401", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/117242555881231477", "content": "I can't imagine trying to manage cPanel on the public Internet in 2026, especially on shared systems.\nhttps://nvd.nist.gov/vuln/detail/cve-2026-67401\nsev:CRIT 9.9  -  CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\n\nA vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component", "creation_timestamp": "2026-09-09T18:43:50.161259Z"}, {"uuid": "264d9aca-6995-41c3-9928-6ce03900fadb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67401", "type": "seen", "source": "https://t.me/pphm_HackerNews/3072", "content": "\ud83d\udd34 New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root\n\ncPanel has patched a flaw that it says lets a single hosting account take control of an entire server. An authenticated account holder with mail-related privileges can create files of their choosing on the server through EmailTrack and, from there, run code as the root user.\n\ncPanel published the advisory on September 8 and says every supported version of cPanel and WHM is affected.\n\nThe flaw is tracked as CVE-2026-67401. cPanel's advisory calls it an SQL injection issue in EmailTrack, but does not say which cPanel feature or privilege an account needs. cPanel's developer documentation lists an EmailTrack module that tracks email statistics, and the advisory does not say whether that is the affected code.", "creation_timestamp": "2026-09-09T20:00:05.656393Z"}, {"uuid": "2c987ed3-de36-48c1-b656-48a786f84f20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67401", "type": "seen", "source": "https://bsky.app/profile/packetstorm.bsky.social/post/3mv4ftaumet2l", "content": "cPanel EmailTrack CVE-2026-67401 Scanner / Mitigation https://packetstorm.news/files/230936 ", "creation_timestamp": "2026-09-09T20:46:36.003720Z"}, {"uuid": "ef76cffe-f32a-4299-bed8-cb2052250c4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67401", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mv4gtpc5xz2t", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-67401: A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component\nCVSS 9.9\nhttps://beta.vulnsea.com/cve/CVE-2026-67401\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-09T21:04:44.762813Z"}, {"uuid": "40cb1f87-f02c-4884-970f-ef86f35c9e84", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67401", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mv4mq3wiih2p", "content": "CVE-2026-67401 - cpanel\ncPanel\u2019s EmailTrack feature lets a specially crafted email cause the server to run any command with full administrative rights. This means an attacker could take control of the whole\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#cpanel #webpros #CVE #infosec", "creation_timestamp": "2026-09-09T22:50:06.221622Z"}, {"uuid": "ab94f545-ab85-4398-b406-a8a51341c71b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67401", "type": "seen", "source": "Telegram/2B9_v_2pPAWOaIEdbs03TiOUAV4_o2Ur3L3sHegl_ON7Vwc", "content": "", "creation_timestamp": "2026-09-09T23:00:04.933157Z"}, {"uuid": "a6557688-6486-4504-a934-7f75ab459a00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67401", "type": "published-proof-of-concept", "source": "Telegram/2B9_v_2pPAWOaIEdbs03TiOUAV4_o2Ur3L3sHegl_ON7Vwc", "content": "", "creation_timestamp": "2026-09-10T00:00:08.830120Z"}, {"uuid": "ed25ef89-53f1-4cd6-b721-8b34d857fb04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67401", "type": "seen", "source": "https://t.me/pphm_HackerNews/3072", "content": "\ud83d\udd34 New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root\n\ncPanel has patched a flaw that it says lets a single hosting account take control of an entire server. An authenticated account holder with mail-related privileges can create files of their choosing on the server through EmailTrack and, from there, run code as the root user.\n\ncPanel published the advisory on September 8 and says every supported version of cPanel and WHM is affected.\n\nThe flaw is tracked as CVE-2026-67401. cPanel's advisory calls it an SQL injection issue in EmailTrack, but does not say which cPanel feature or privilege an account needs. cPanel's developer documentation lists an EmailTrack module that tracks email statistics, and the advisory does not say whether that is the affected code.", "creation_timestamp": "2026-09-10T00:00:12.645123Z"}, {"uuid": "f0a66811-0e58-47fd-9812-c38a604f97bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67401", "type": "seen", "source": "https://t.me/thehackernews/10009", "content": "\u203c\ufe0fWarning: New CVE-2026-67401 vulnerability in cPanel lets mail-privileged hosting accounts execute code as root.\n\ncPanel says every supported cPanel & WHM version is affected and has released fixed builds.\n\nRead details here: https://thehackernews.com/2026/09/new-cpanel-flaw-lets-hosting-account.html", "creation_timestamp": "2026-09-10T00:00:41.054563Z"}, {"uuid": "27b89961-cd9f-4a99-ad75-a52a0381c76e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67401", "type": "published-proof-of-concept", "source": "Telegram/j0PsdiAJ2pcbJR995Thb3rfk0dWAfkhfh9U9VXIxLqzuXI0", "content": "", "creation_timestamp": "2026-09-10T00:00:41.137122Z"}, {"uuid": "de1fb972-c55f-4d55-9542-fe81a15a2b72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67401", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/101805", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-67401\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a axedos\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-09 10:46:53\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\npoc in python for CVE-2026-67401\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-10T00:00:39.017366Z"}, {"uuid": "c543a8b6-bca3-4530-99ca-351377919765", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67401", "type": "seen", "source": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3mv4th4pwl22o", "content": "cPanel & WHM\u306eEmailTrack\u306bSQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u8106\u5f31\u6027\u300cCVE-2026-67401\u300d\u3001root\u6a29\u9650\u3067\u30b3\u30fc\u30c9\u5b9f\u884c\u306e\u304a\u305d\u308c \n rocket-boys.co.jp/security-mea... \n\n#\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5bfe\u7b56Lab #security #securitynews #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3", "creation_timestamp": "2026-09-10T00:50:25.095415Z"}, {"uuid": "e4d50e02-5756-4057-be51-2bc62a0449e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67401", "type": "published-proof-of-concept", "source": "Telegram/ywbCj1qC377X1uevfG1yFHPTnDAYE7AO0rak_508q64VcZA", "content": "", "creation_timestamp": "2026-09-10T05:00:04.984369Z"}, {"uuid": "570b8a53-a33e-4c37-9cd8-7ff1610761f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67401", "type": "seen", "source": "https://t.me/GithubRedTeam/101929", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-67401-cPanel-EmailTrack-SQLi\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a jithinkrishnanrs\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-10 11:27:20\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-67401 cPanel & WHM EmailTrack SQL Injection \u2014 IOC scanner, compromise detection, patch verification, incident response and remediation toolkit.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-10T15:00:05.889575Z"}]}