VulnSocial
← Back to blog

CVE-2026-41940 – Critical Authentication Bypass in cPanel & WHM

Key Takeaways

  • Critical authentication bypass in cPanel and WHM.
  • Affects all versions released after 11.40, including DNSOnly and WP² (WordPress Squared) deployments.
  • Active exploitation observed in the wild; included in CISA KEV.
  • Patch released 2026‑04‑28 – update to the latest branch versions immediately.
  • After patching, rotate all privileged credentials and audit for compromise.

Overview

The CVE-2026-41940 vulnerability is rated Critical (CVSS 3.1 base 9.8, CVSS 4.0 base 9.3) and permits an unauthenticated remote attacker to bypass the login flow of cPanel and its administrative counterpart WHM. By manipulating a session cookie and injecting crafted data into the temporary session file, the attacker can force the control panel to treat the request as an already‑authenticated root session. The flaw affects every supported release after version 11.40, including the DNSOnly mode and the WP² (WordPress Squared) integration.

Active exploitation was reported within days of disclosure, and the vulnerability was added to the CISA KEV catalog on 2026‑04‑30. Threat actors have leveraged the bypass to deploy ransomware (e.g., “Sorry” ransomware) and install backdoors on compromised hosting environments.

For live threat activity, signal trends, and detailed indicator counts, see the VulnSocial CVE page.

Technical Details

  1. Pre‑auth session creation – An attacker sends a deliberately failed login request. cPanel creates a temporary “login attempt” record on disk and issues a session cookie tied to that record.
  2. Cookie tampering – By flipping a single flag in the cookie, the attacker disables the normal password‑encryption step, causing the password field to be stored in clear text.
  3. CRLF/Line‑break injection – The attacker crafts a login payload containing hidden line‑break characters. cPanel does not strip these characters, so they are written verbatim into the session file. Each injected line can declare arbitrary session attributes, such as user=root and auth_success=1.
  4. Session replay – A subsequent request forces cPanel to re‑read the poisoned session file, promoting the forged attributes to the active session.
  5. Privilege escalation – On the next request, cPanel sees the auth_success flag and grants full administrative (root) access without checking the password.

The exploit chain can be completed in a handful of HTTP requests and requires no valid credentials. Public PoC scripts (e.g., cPanelSniper, watchTowr‑vs‑cPanel‑WHM‑AuthBypass‑to‑RCE.py) automate the steps and have been observed in the wild.

Severity & Impact

MetricValue
CVSS 3.19.8 (Critical)
CVSS 4.09.3 (Critical)
CWECWE‑306 – Missing Authentication for Critical Function
ImpactFull administrative control of the server (root/WHM) – leads to data theft, ransomware deployment, and persistent backdoors.

Affected Products

  • Vendor: cPanel
  • Products: cPanel, WHM, WP² (WordPress Squared)
  • Versions: All releases after 11.40 (including DNSOnly mode).

For the complete list of affected versions and CPE entries, see the CVE page.

Actionable Insights – What to Do Now

  • Patch immediately – Apply the vendor security update released on 2026‑04‑28. Updated branch versions include:

    • 11.110.0.97 (110.0.x)
    • 11.118.0.63 (118.0.x)
    • 11.126.0.54 (126.0.x)
    • 11.132.0.29 (132.0.x)
    • 11.134.0.20 (134.0.x)
    • 11.136.0.5 (136.0.x)

  • Rotate all privileged credentials – After patching, reset root passwords, API tokens, SSH keys, database passwords, and SSL private keys.

  • Audit session files – Look for unexpected user=root or auth_success=1 entries in /var/cpanel/sessions/ (or equivalent).

  • Enable multi‑factor authentication (MFA) for all cPanel/WHM accounts.

  • Restrict access – Limit cPanel/WHM access to trusted IP ranges or VPN endpoints.

  • Deploy WAF/IPS rules – Block CRLF payloads and malformed Authorization headers that attempt line‑break injection.

  • Monitor for IOCs – Watch for the creation of new session files, unusual login patterns, and the presence of ransomware extensions (e.g., “.sorry”).

Remediation & Mitigation Steps

  1. Patch the control panel to the latest version listed above.
  2. Rotate all root and privileged credentials (passwords, API tokens, SSH keys, SSL private keys).
  3. Inspect cPanel session directories for suspicious entries and delete any that appear forged.
  4. Enable two‑factor authentication for all administrative accounts.
  5. Restrict network access to cPanel/WHM ports (2082/2083, 2086/2087) using firewalls or VPNs.
  6. Deploy web‑application firewall signatures that detect CRLF injection in HTTP headers and cookies.
  7. Monitor logs for repeated failed login attempts followed by successful admin sessions from the same IP.

Bottom Line

CVE-2026-41940 is a Critical authentication bypass that grants unauthenticated attackers full root control over cPanel/WHM servers. The vulnerability is actively exploited and listed in the CISA KEV catalog. Immediate patching, credential rotation, and hardening of access controls are essential to stop ongoing attacks and prevent future compromise.

References

For continuous updates and community signals, visit the VulnSocial CVE page.