A critical SQL injection vulnerability in cPanel allows authenticated mail account users to gain full root-level remote code execution on the server.

The flaw is an SQL injection (CWE-89) within the EmailTrack component. It requires the attacker to have an authenticated mail-enabled account to exploit the database query logic and escalate privileges to root.

This vulnerability poses a catastrophic risk to organizational infrastructure, as it grants an attacker complete control over the affected cPanel server. With root-level access, an adversary can exfiltrate sensitive data, manipulate system configurations, or deploy persistent backdoors, leading to total system compromise and severe reputational damage. Given the CVSS score of 9.9, this vulnerability must be treated as a highest-priority security event.

Immediate Action: Update cPanel to the patched versions specified in the vendor advisory: 11.134.0.55, 11.136.0.39, 11.138.0.4, or 11.138.1.9.

Proactive Monitoring: Audit server logs for unusual database queries originating from mail-enabled accounts and monitor for unexpected process creation by the cPanel user.

Compensating Controls: Implement Web Application Firewall (WAF) rules specifically designed to detect and block SQL injection patterns targeting the cPanel EmailTrack endpoint until the patch is applied.

Public Exploit Available: Yes, multiple public proof-of-concept repositories exist on GitHub.

The severity of this vulnerability cannot be overstated given the potential for full administrative takeover of the host server. IT administrators should prioritize the deployment of the provided vendor patches immediately across all affected environments to prevent unauthorized access and potential data breaches.