--- title: CVE-2026-41940: Critical cPanel/WHM authentication... description: A critical authentication bypass vulnerability (CVE-2026-41940, CVSS 9.8) in cPanel, WHM, and WP Squared was patched on April 28, 2026, but exploitation had... canonical: https://daily.dev/posts/cve-2026-41940-critical-cpanel-whm-authentication-bypass-exploited-in-the-wild-patch-now-available-ebftlbl75 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: CVE-2026-41940: Critical cPanel/WHM authentication bypass exploited in the wild, patch now available | daily.dev og:description: A critical authentication bypass vulnerability (CVE-2026-41940, CVSS 9.8) in cPanel, WHM, and WP Squared was patched on April 28, 2026, but exploitation had... og:url: https://daily.dev/posts/cve-2026-41940-critical-cpanel-whm-authentication-bypass-exploited-in-the-wild-patch-now-available-ebftlbl75 og:image: https://api.daily.dev/og/posts/ebFTLBl75.png og:image:alt: CVE-2026-41940: Critical cPanel/WHM authentication bypass exploited in the wild, patch now available og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # CVE-2026-41940: Critical cPanel/WHM authentication bypass exploited in the wild, patch now available **[Collections](https://daily.dev/sources/collections)** · 4 min read · 1 upvotes · 0 comments ## Summary A critical authentication bypass vulnerability (CVE-2026-41940, CVSS 9.8) in cPanel, WHM, and WP Squared was patched on April 28, 2026, but exploitation had been underway since at least February 23 — over two months earlier. The flaw is a CRLF injection in session handling that allows unauthenticated attackers to gain full administrative access. With ~1.5 million internet-exposed instances, the impact is massive: ~550,000 servers remain vulnerable, ~2,000 confirmed compromised, and 44,000 IPs hit by 'Sorry' ransomware (Go-based, ChaCha20+RSA-2048). Mirai botnet recruitment and backdoor installations are also ongoing. Admins must manually run `/scripts/upcp --force` to patch, block cPanel ports as a stopgap, rotate credentials, and treat any unpatched system as already compromised. CISA added it to the KEV catalog. Separately, Palo Alto PAN-OS has a critical buffer overflow (CVE-2026-0300, CVSS 9.3) under active exploitation with patches expected mid-to-late May. ## Content ## What happened On April 28, 2026, cPanel released emergency patches for a critical authentication bypass vulnerability (CVE-2026-41940, CVSS 9.8) affecting cPanel, WebHost Manager (WHM), and WP Squared. The flaw is a CRLF injection issue in the login and session handling process: unsanitized user input from the Authorization header gets written into server-side session files before authentication completes. An attacker can craft a session cookie via a failed login, send a specially crafted header that bypasses encryption of user-supplied values, and gain full administrative access to the server — including its configurations, databases, and every website it hosts. With roughly 1.5 million cPanel instances exposed to the internet, powering an estimated 70 million domains, the blast radius here is significant. ## It was already being exploited before the patch This wasn't a case of attackers racing to exploit a newly disclosed bug. Evidence from multiple hosting providers suggests exploitation was underway by at least February 23, 2026 — more than two months before the patch dropped. KnownHost reported unauthorized access attempts dating to that date. WatchTowr Labs found signs of zero-day exploitation going back at least 30 days before disclosure. Within 24 hours of public disclosure, multiple proof-of-concept exploits appeared, including one from WatchTowr Labs. Censys scans found around 15,000 potentially compromised instances on day one alone. ## What attackers are doing with it The exploitation isn't just opportunistic scanning. Attackers are deploying real payloads: - **"Sorry" ransomware**: A Go-based ransomware that encrypts files with ChaCha20, protects the key with RSA-2048, appends a `.sorry` extension, and drops a `README.md` ransom note directing victims to contact attackers via Tox. At least 44,000 IP addresses have been compromised in these attacks. One small business reported a $7,000 ransom demand. - **Mirai botnet variants**: Compromised servers are being folded into DDoS infrastructure. - **Backdoor installation and spam campaigns**: Standard post-compromise activity on servers with access to large numbers of hosted domains. Around 550,000 servers remain potentially vulnerable as of the latest estimates, with roughly 2,000 confirmed compromised. ## How hosting providers responded Namecheap temporarily blocked external access to cPanel and WHM ports as a precaution. HostGator patched affected systems. CISA added CVE-2026-41940 to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch by the following Sunday. Canada's cybersecurity agency issued an advisory calling exploitation "highly probable." WebPros, the company behind cPanel, has not made public statements beyond the patch release. ## How to fix it cPanel released fixes across six version branches on April 28. The update does not apply automatically — administrators need to run: ``` /scripts/upcp --force ``` If immediate patching isn't possible, block external access to TCP ports 2083, 2087, 2095, and 2096, or stop the `cpsrvd` and `cpdavd` services entirely. After patching, rotate credentials and purge active sessions. Both cPanel and WatchTowr Labs have published detection scripts to check for signs of prior compromise. Given that exploitation predates the patch by months, any unpatched system should be treated as potentially compromised rather than just at risk. --- ## Also: separate critical bug in Palo Alto PAN-OS Unrelated to the cPanel issue but worth noting alongside it: Palo Alto Networks disclosed CVE-2026-0300 (CVSS 9.3), a critical buffer overflow in the User-ID Authentication Portal (Captive Portal) component of PAN-OS. Unauthenticated attackers can send specially crafted packets to execute arbitrary code with root privileges on PA-Series and VM-Series firewalls running PAN-OS versions 10.2, 11.1, and 12.1. Active exploitation has been confirmed. CISA added it to the KEV catalog with a federal remediation deadline of May 9, 2026. Patches are expected between May 13–28 depending on version. Workarounds include restricting Authentication Portal access to trusted internal zones, disabling Response Pages on untrusted interfaces, or disabling the portal entirely if it's not in use. Customers with Threat Prevention subscriptions can use Threat ID 510019. Prisma Access, Cloud NGFW, and Panorama are not affected. ## Similar posts on daily.dev - [Pentest-Tools.com Releases Free Scanner for CVE-2026-41940 as cPanel Authentication Bypass Enters Its Third Week of Active Exploitation](https://daily.dev/posts/pentest-tools-com-releases-free-scanner-for-cve-2026-41940-as-cpanel-authentication-bypass-enters-it-s5ky32w4r) · IT Security Guru · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/cve-2026-41940-critical-cpanel-whm-authentication-bypass-exploited-in-the-wild-patch-now-available-ebftlbl75) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"CVE-2026-41940: Critical cPanel/WHM authentication bypass exploited in the wild, patch now available","url":"https://daily.dev/posts/cve-2026-41940-critical-cpanel-whm-authentication-bypass-exploited-in-the-wild-patch-now-available-ebftlbl75","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cve-2026-41940-critical-cpanel-whm-authentication-bypass-exploited-in-the-wild-patch-now-available-ebftlbl75"},"datePublished":"2026-04-30T20:56:34.518Z","dateModified":"2026-05-07T17:25:24.116Z","description":"A critical authentication bypass vulnerability (CVE-2026-41940, CVSS 9.8) in cPanel, WHM, and WP Squared was patched on April 28, 2026, but exploitation had...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d70489f6abc7647b8cb6a359027af983?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d70489f6abc7647b8cb6a359027af983?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cve-2026-41940-critical-cpanel-whm-authentication-bypass-exploited-in-the-wild-patch-now-available-ebftlbl75","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"CVE-2026-41940: Critical cPanel/WHM authentication bypass exploited in the wild, patch now available"}]} ```