Customers hosted on our [cpres4, cwh19, cwh23, cwh24, cwh900, cwh901, cwh902, cwh903, cwh905, cwh906, mm1] are experiencing Email service interruption.
For reference, please see https://support.cpanel.net/hc/en-us/articles/43187903921559-Security-CVE-2026-67401-SQL-Injection-Vulnerability-in-cPanel-s-EmailTrack-Functionality-September-8-2026
cPanel recently disclosed a security vulnerability, CVE-2026-67401, affecting its EmailTrack functionality. According to cPanel, an authenticated cPanel account with mail-related privileges could potentially exploit the vulnerability to create arbitrary files on the server. Successful exploitation could enable code execution with root-level privileges, providing full control of an affected server.
What are we doing?
As an immediate precaution, we will be disabling the email services on the affected server.
This will prevent the vulnerable email functionality from being available while we determine the appropriate long-term solution for the server.
Why are we taking this step?
This is a precautionary security measure. We are taking this action because leaving the vulnerable email functionality enabled could potentially expose the server to a serious security risk.
Our priority is to protect the server and the websites and services hosted on it while we work toward a longer-term solution.
What happens next?
Since the server runs a version that has already reached EOL and is no longer supported by cPanel, the only available option is to migrate your account to one of our newer servers. Newer servers utilize MySQL8.x, and we request that you check if this will be compatible with your website application. If you require us to migrate your account to our latest servers, please open a ticket with us, and we can start the migration process. We will provide new nameservers to be used with your account, which you would need to set for your domain at the registrar for the respective domain.
If you do not use email services through your hosting account, no action is required on your part.
If you do use email services on this server, we recommend reviewing your current email requirements and considering whether you need to make temporary or permanent alternative email arrangements.
