Column 1
Skip to content

cPanel CVE-2026-67401: Patch WHM and Verify Your Branch

September 9, 2026

cPanel CVE-2026-67401 needs a server-side update. WebPros reports that an authenticated cPanel account with mail-related privileges can abuse a vulnerable feature, with successful exploitation leading to code execution as root. A WordPress plugin update does not replace the cPanel & WHM correction.

Scope notice: Fix I.T. Phill has not assessed your server or hosting account. This guide summarizes public vendor guidance; it is not evidence that your host is affected or compromised. The featured image is a general hosting-security illustration, not a screenshot of a tested or patched server.

Match the patched version to your branch

The cPanel security advisory, updated September 8, lists these patched versions. Record your installed branch and full version before choosing the applicable update.

  • 110: 11.110.0.143
  • 134: 11.134.0.55
  • 136: 11.136.0.39
  • 138: 11.138.0.4
  • WP2: 11.138.1.9

Use the current vendor-supported correction for your branch. Do not treat a higher major-version number, a generic update-success message, or the fact that a website loads as proof that the applicable correction is installed. The published CNA record identifies the affected product and version boundaries; the vendor advisory is the source for the branch-specific patched-version list.

Who should take action?

Shared-hosting customers: ask your provider to confirm the server’s cPanel & WHM branch, full patched version and completed maintenance. You may not control server updates from your account. Keep the provider’s confirmation with your maintenance record rather than guessing from a theme, plugin or PHP version.

Server owners and hosting teams: plan the vendor-supported update with the person responsible for the host. Confirm your normal recovery arrangements and maintenance contacts without changing customer backup schedules as part of this checklist. Where a wider branch migration is necessary, keep that planning distinct from verifying this security correction.

Our cPanel 134 LTS planning guide, 136 branch checklist and 138 rollout checklist provide related maintenance context. Their earlier versions and publication dates are not substitutes for the patched versions above.

Verify maintenance and keep recovery separate

  • Recheck the full installed version after maintenance and compare it with the current vendor advisory.
  • Confirm administrator access and ordinary mail workflows with harmless test content. Check the customer-facing website and relevant WordPress or WooCommerce workflows separately.
  • Record who performed the update, the completed version and any unresolved service errors. Share only the minimum necessary details through your provider’s private support channel.
  • If there are signs of unauthorized changes, involve the hosting provider or an incident-response professional. Installing an update alone does not establish that an earlier compromise has been resolved.

For help coordinating the WordPress side of hosting maintenance, see WordPress support. This article does not claim active exploitation on your server and does not provide attack instructions.