CVE-2026-41940 Scanner - cPanel & WHM Authentication Bypass

Technical details

CVE-2026-41940 is a critical authentication bypass vulnerability affecting cPanel & WHM and WP Squared, disclosed on April 28, 2026. The root cause is a CRLF injection flaw in the way cPanel reads and writes session files.

Specifically, cpsrvd - the cPanel service daemon - writes a new session file to disk before authentication completes. An attacker can manipulate the whostmgrsession cookie by omitting an expected segment of the cookie value, causing cpsrvd to bypass the normal encryption process when writing the session file. By injecting \r\n sequences into user-controlled input that ends up in that file, the attacker inserts arbitrary key-value pairs - including authentication state flags - before the session is ever validated.

The result: an unauthenticated attacker can craft a request that, when processed by cPanel, writes a session file containing cp_auth=1 (or an equivalent authentication flag). On the attacker's next request, cPanel reads back the tampered session file and treats the session as authenticated - granting full access to the cPanel or WHM interface without ever supplying valid credentials.

cPanel is one of the most widely deployed web hosting control panels in the world, running across hosting environments that serve enterprises, government agencies, banks, and hundreds of thousands of smaller organizations globally. A single cPanel server typically hosts dozens to hundreds of separate customer sites - meaning a successful unauthenticated authentication bypass doesn't just affect one target, it potentially exposes every account on that server.

That's what makes CVE-2026-41940 unusually high-stakes: the vulnerability is in the infrastructure that underlies a large portion of the hosted web itself.

How we detect CVE-2026-41940

Our Network Vulnerability Scanner sends multiple crafted requests to the target's cPanel login endpoint, injecting CRLF sequences into session-related parameters.

Detection is confirmed through multiple tactics, not inferred from version banners alone. The scanner validates exploitability by observing the server's actual response to the crafted payload.

Products affected by CVE-2026-41940

This vulnerability affects cPanel & WHM and WP Squared. Both the cPanel (user-facing) and WHM (host-facing) interfaces are impacted, since they share the underlying session-handling code.

Affected components include:

• cPanel user interface (port 2082 / 2083)
• WHM administrator interface (port 2086 / 2087)
• cPanel XML-API and UAPI endpoints that rely on session authentication
• WP Squared (WordPress hosting platform built on cPanel)

The following cPanel & WHM versions are vulnerable (all versions prior to the patched releases listed below):

Source: NVD / VulnCheck advisory, April 29, 2026..

CVE-2026-41940 severity

CVE-2026-41940 carries a critical severity rating of 9.8.

Given exploitation requires no authentication, no user interaction, and no special privileges, a CVSSv3 base score in the 9.x–10.0 range is expected.

How attackers can exploit CVE-2026-41940

This vulnerability is straightforward to exploit remotely:

• No credentials required - unauthenticated exploitation.
• No user interaction required - the attacker does not need to trick anyone into clicking a link.
• Remotely exploitable - any internet-exposed cPanel or WHM instance is at risk.
• Public PoC available - watchTowr and Searchlight Cyber published a detailed proof-of-concept alongside their disclosure.

The real-world impact of a successful exploit is severe.

Once authenticated to cPanel, an attacker can:

• read and modify all files hosted on the account
• access databases
• steal stored credentials
• deploy webshells or malware
• escalate to WebHost Manager (root-level) access via privilege escalation chains
• pivot to other hosted sites on the same server

CVE-2026-41940 disclosure timeline

How to mitigate CVE-2026-41940

The primary remediation is to update cPanel & WHM to a patched version immediately. Vendor advisories are available for cPanel & WHM and WP Squared. Given that active exploitation is confirmed and a public PoC exists, treat this as an emergency patch.

If you cannot update immediately, apply these mitigating controls - but understand they are not fixes:

• Restrict access to cPanel and WHM interfaces (ports 2082, 2083, 2086, 2087) to trusted IP ranges using firewall rules or cPanel's Host Access Control.
• Disable external access to the WHM interface if it is not required by your operations.
• If your infrastructure sits behind Cloudflare, verify that the Cloudflare Managed Ruleset is enabled - an emergency WAF rule blocking CVE-2026-41940 exploitation attempts was deployed on April 30, 2026. This is a partial control, not a substitute for patching.
• Monitor cPanel access logs for unexpected authenticated sessions, especially from unfamiliar IPs or with unusually short authentication times.
• Enable cPHulk Brute Force Protection, which may partially limit some exploitation patterns.

Note: IP restrictions, WAF rules, and logging are mitigating controls. The only reliable remediation is applying the vendor patch.

CVE-2026-41940 references

• Pentest-Tools.com Vulnerability & Exploit Database - CVE-2026-41940
• cPanel & WHM vendor security advisory (April 28, 2026)
• watchTowr Labs - technical analysis and PoC
• Searchlight Cyber - technical analysis and PoC
• NVD - CVE-2026-41940
• Cloudflare emergency WAF rule - April 30, 2026
• WP Squared vendor advisory

Our Network Vulnerability Scanner is a well-rounded tool for all your network security assessments.

It combines multiple engines and fine-tuned (customizable) scan settings which surface almost 17,000 vulnerabilities, misconfigurations, and outdated services.

Each scan automatically updates your attack surface and provides an up-to-date map for planning targeted attacks or strategic lateral movements.

Explore a sample report which includes a vulnerability summary, automatically confirmed findings, evidence, and more.

In a transparent benchmark, our tool outperformed the 6 most popular network scanners on the market - both open-source and commercial.