CVE-2026-67401
45Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 9.9
from disclosure to weapon0 days
Published on NVDSep 9
1st PoCSep 9
exploitation probability
—
observed exploitation
nono source reports it
3 public exploit(s)
A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
WebPros · cPanelpublic PoCs found — 3
githubgithub.com/axedos/CVE-2026-67401★ 1githubgithub.com/HORKimhab/CVE-2026-67401★ 0githubgithub.com/jithinkrishnanrs/CVE-2026-67401-cPanel-EmailTrack-SQLi★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.