cPanel Patches Bug That Let One Mail Account Hijack a Whole Server
A flaw in cPanel's EmailTrack tool let any authenticated mailbox user write files and run commands as root, the top-level administrator with total control of the machine.
Key points
- cPanel published a security advisory on September 8, 2025 covering a flaw that lets one hosting account take over the entire server.
- The bug sits in EmailTrack, a mail-logging feature, and needs only an authenticated account with mail privileges to exploit.
- Every currently supported version of cPanel and WHM is affected, and administrators are urged to update immediately.
- Successful exploitation gives an attacker root access, the highest level of control on a Linux server.
cPanel, the software that millions of shared web-hosting servers use to manage websites and email, has fixed a serious flaw that turned a single email account into a skeleton key for the whole machine.
The bug lives in EmailTrack, the part of cPanel that logs and reports on outgoing mail. An attacker who already has a hosting account with mail privileges (in other words, any normal customer on a shared server) could use it to write files of their choice onto the server. From there, they could run commands as root, the top-level Linux user that controls everything.
In plain terms: one paying customer on a shared host could seize the entire server, along with every other customer's website and mailbox sitting on it.
cPanel published its advisory on September 8, 2025 and says every supported version of cPanel and WHM (Web Host Manager, the admin side of the same product) is affected. The vendor has not, at time of writing, released a numbered CVE identifier for public tracking.
How bad is this in practice?
Bad, if you run a shared hosting server and have not patched. The attacker needs a valid login, so this is not something a random stranger on the internet can fire off. But shared hosting exists precisely to sell cheap accounts to strangers, so the barrier is a credit card, not a zero-day.
Once root is reached, the attacker can read any file on the box, install backdoors, harvest customer databases, plant malware in every hosted website, or quietly forward all inbound email. Recovery usually means rebuilding the server from scratch.
The flaw is what the industry calls a privilege escalation: it does not get you in the front door, it promotes you once you are inside. That is the class of bug most likely to be chained after a stolen or brute-forced cPanel password, which is why it matters more than the "authenticated only" label suggests.
Who needs to act?
Hosting providers and anyone self-hosting cPanel or WHM. End customers, the small businesses and bloggers whose sites sit on these servers, cannot patch this themselves. It is the host's job.
If you are a customer, it is fair to ask your provider whether they have applied the September 8 cPanel update. A one-line email will do.
| Item | Detail |
|---|---|
| Product | cPanel and WHM |
| Affected versions | All currently supported releases |
| Component | EmailTrack |
| Access needed | Authenticated account with mail privileges |
| Result of exploit | Code execution as root |
| Advisory date | September 8, 2025 |
Would MFA have helped?
Honestly, only indirectly. Multi-factor authentication, the second login step that asks for a code from your phone, would make it harder for an outsider to steal a cPanel account and then abuse this bug. It would not stop a legitimate paying customer on a shared server from exploiting it. The real fix is the patch.
The reporting on the underlying advisory was picked up by The Hacker News. cPanel's own security notice remains the authoritative source for version numbers and upgrade paths, and administrators should follow it rather than any third-party summary.
One small mercy: cPanel's automatic update channel, which most managed hosts leave enabled, should already be pulling the fix down. If you administer your own box and switched auto-updates off, now is the moment to log in.
