Security Advisories for cPanel WHM and ConfigServer Security & Firewall

WebPros has issued a security advisory (AV26-908) regarding multiple vulnerabilities impacting cPanel & WebHost Manager (WHM) and ConfigServer Security & Firewall (CSF). The most notable vulnerability, tracked as CVE-2026-67401, is a SQL injection flaw identified within the cPanel EmailTrack functionality. Additionally, two vulnerabilities, CVE-2026-65638 and CVE-2026-65639, have been identified in CSF, necessitating immediate patching. Organizations utilizing these products are at risk of unauthorized database access or potential security feature bypass if left unpatched. Defenders should prioritize updating cPanel & WHM to version 11.110.0.143, 11.134.0.55, 11.136.0.39, 11.138.0.4, or 11.138.1.9 (WP2) respectively, and updating CSF to the latest available version beyond 16.29.

Impact

Successful exploitation of CVE-2026-67401 could allow unauthenticated or authenticated attackers to perform SQL injection attacks against the cPanel EmailTrack module, potentially leading to unauthorized data exfiltration or manipulation of the backend database. CSF vulnerabilities CVE-2026-65638 and CVE-2026-65639 impact the security infrastructure of the hosting environment, potentially allowing for the circumvention of firewall rules. These flaws impact a broad range of web hosting environments globally.

Recommendation

• Patch cPanel & WebHost Manager immediately to the specified versions (11.110.0.143, 11.134.0.55, 11.136.0.39, 11.138.0.4, or 11.138.1.9) as documented in the WebPros advisory.
• Update ConfigServer Security & Firewall (CSF) to versions beyond 16.29 to remediate CVE-2026-65638 and CVE-2026-65639.
• Audit logs for web requests targeting /scripts/emailtrack or similar endpoints associated with the vulnerable EmailTrack functionality.
• Monitor for anomalous database queries or unusual error patterns in web server logs that may indicate SQL injection attempts.