cPanel Patches Bug That Let One Mail Account Hijack a Whole Server
A flaw in cPanel's EmailTrack tool let any authenticated mailbox user write files and run commands as root, the top-level administrator with total control of the machine.
Key points
- CPanel published a security advisory on September 8, 2026 covering a flaw that lets one hosting account take over the entire server.
- The bug sits in EmailTrack, a mail-logging component, and needs only an authenticated account with mail privileges to exploit.
- Every currently supported version of cPanel and WHM is affected, and administrators are urged to update immediately.
- Successful exploitation gives an attacker root access, the highest level of control on a Linux server.
CPanel, the software that millions of shared web-hosting servers use to manage websites and email, has fixed a serious flaw that turned a single email account into a skeleton key for the whole machine.
The bug lives in EmailTrack, the part of cPanel that logs and reports on outgoing mail. An attacker who already holds a hosting account with mail privileges could use it to write files of their choice onto the server, then run commands as root, the top-level Linux user that controls everything. This is the third root-level privilege escalation on cPanel infrastructure we've reported since July, following the domain-parking flaw CVE-2026-65643 in August and the database flaw CVE-2026-58048 in early August.
In plain terms: one paying customer on a shared host could seize the entire server, along with every other customer's website and mailbox on it.
CPanel published its advisory on September 8, 2026 and says every supported version of cPanel and WHM (Web Host Manager, the admin-facing side of the same product) is affected. The vendor had not released a numbered CVE identifier at time of writing.
How bad is this in practice?
Bad, if you run a shared hosting server and haven't patched. The attacker needs a valid login, so this isn't something a random stranger can fire off blindly. But shared hosting exists precisely to sell cheap accounts to strangers, so the barrier is a credit card, not a zero-day.
Once root is reached, the attacker can read any file on the box, install backdoors, harvest customer databases, plant malware in every hosted website, or quietly forward all inbound email. Recovery usually means rebuilding the server from scratch.
The flaw is a privilege escalation: it doesn't get you in the front door, it promotes you once you're inside. That's the class of bug most likely to be chained after a stolen or brute-forced cPanel password, and it's exactly what makes the "authenticated only" label less reassuring than it sounds.
Who needs to act?
Hosting providers and anyone self-hosting cPanel or WHM. End customers, the small businesses and bloggers whose sites sit on these servers, can't patch this themselves. It's the host's job.
If you're a customer, asking your provider whether they've applied the September 8 cPanel update is entirely reasonable. A one-line email will do.
| Item | Detail |
|---|---|
| Product | cPanel and WHM |
| Affected versions | All currently supported releases |
| Component | EmailTrack |
| Access needed | Authenticated account with mail privileges |
| Result of exploit | Code execution as root |
| Advisory date | September 8, 2026 |
Would MFA have helped?
Only indirectly. Multi-factor authentication, the second login step that asks for a code from your phone, would make it harder for an outsider to steal a cPanel account and then abuse this bug. It wouldn't stop a legitimate paying customer on a shared server from exploiting it. Patch first.
CPanel's own security notice remains the authoritative source for version numbers and upgrade paths. The reporting was first picked up by The Hacker News.
One small mercy: cPanel's automatic update channel, which most managed hosts leave enabled, should already be pulling the fix down. If you administer your own box and switched auto-updates off, now is the time to log in.
