CVE-2026-41940 cPanel and WHM Auth Bypass

On April 28, 2026, WebPros International, the company behind cPanel and WHM, published an emergency security advisory for CVE-2026-41940, a critical authentication bypass affecting effectively every supported version of the platform. The flaw carries a CVSS v3.1 score of 9.8 and has been added to the CISA Known Exploited Vulnerabilities catalog. Telemetry from the Shadowserver Foundation observed roughly 44,000 unique IP addresses scanning, brute forcing, or running exploit payloads against honeypot sensors within 48 hours of disclosure.

This post walks through what the vulnerability actually is, how the exploit chain works, which versions are affected, and exactly what you need to do to patch and verify a clean recovery.

Executive Summary#

CVE-2026-41940 is an unauthenticated remote authentication bypass in cPanel and WHM caused by a Carriage Return / Line Feed (CRLF) injection in the session writing path, combined with a cookie-driven encryption skip and a session cache promotion quirk. A successful exploit yields full root-equivalent access to WHM, every cPanel account on the host, all hosted databases, and every email mailbox.

Disclosure date: April 28, 2026

CVSS v3.1: 9.8 (Critical)

Vector: AV / AC / PR / UI / S / C / I / A

Affected: All supported cPanel and WHM versions after 11.40, plus WP Squared

In-the-wild exploitation since at least February 23, 2026

Internet-exposed instances: approximately 1.5 million (Shodan)

Status: CISA KEV listed; public PoC available

Root Cause#

The bug lives in three Perl modules that handle session persistence: Cpanel/Session.pm (saver), Cpanel/Session/Load.pm (loader), and Cpanel/Session/Encoder.pm (encoding primitives).

The saver function saveSession fails to sanitize raw CRLF characters out of the password field before serializing the session to disk. The encryption layer that normally protects session writes is also bypassed when the per-session secret, passed as the ob parameter inside the whostmgrsession cookie, is absent. Together these two flaws turn the on-disk session file into a writable, attacker-controlled key/value store.

The Exploitation Chain#

The attack proceeds in four distinct stages.

Stage 1: Preauth Session Creation#

The attacker initiates a deliberately failed login. cPanel still issues a valid preauth session ID with minimal privileges and writes a session record to /var/cpanel/sessions/raw/session_id.

Stage 2: CRLF Injection via Basic Auth#

Using HTTP Basic authentication and a modified whostmgrsession cookie with the hex obfuscation suffix stripped, the attacker sends a password value containing literal newline sequences. The injected payload includes forged session attributes such as hasroot=1, successful_internal_auth_with_timestamp=9999999999, and user=root. The set_pass() routine inside cpsrvd only strips null bytes, leaving CRLF characters intact when the value is passed to saveSession.

Stage 3: Cache Promotion#

The attacker issues a request that lacks a valid security token, deliberately routing execution into do_token_denied, which calls Cpanel::Session::Modify::new() and save(). Those functions read the raw text session file and serialize the parsed result into the JSON cache, promoting every attacker-injected attribute to the top level of the trusted session object.

Stage 4: Authentication Bypass#

On the next authenticated call, docheckpass_whostmgrd finds successful_internal_auth_with_timestamp present and skips the password check against /etc/shadow entirely. The attacker is now root inside WHM.

Affected and Patched Versions#

WebPros shipped fixed builds across every supported tier. Match your current tier and update to the corresponding patched build.

Tier 11.86 (EL6/CL6): patched at 11.86.0.41

Tier 11.110: patched at 11.110.0.97

Tier 11.118: patched at 11.118.0.63

Tier 11.124: patched at 11.124.0.35

Tier 11.126: patched at 11.126.0.54

Tier 11.130: patched at 11.130.0.19

Tier 11.132: patched at 11.132.0.29

Tier 11.134: patched at 11.134.0.20

Tier 11.136: patched at 11.136.0.5

WP Squared: patched at 136.1.7

Tiers 11.112, 11.114, 11.116, 11.120, 11.122, and 11.128 have no dedicated patch and must migrate to a patched tier or block external access until they can.

How to Patch#

The standard remediation path is an in-place upgrade through cPanel’s update pipeline.

Step 1: Confirm your current version#

/usr/local/cpanel/cpanel -V

Step 2: Force an immediate upgrade#

/scripts/upcp --force

A force upgrade typically takes ten to thirty minutes on a mid-sized server and will restart cpsrvd, cpdavd, exim, dovecot, and the database engine.

Step 3: Hard restart cpsrvd#

/scripts/restartsrv_cpsrvd --hard

Step 4: Verify the patched build#

/usr/local/cpanel/cpanel -V

The reported build must match the patched version for your tier in the list above.

Special Case: CentOS 6 and CloudLinux 6 on v110.0.50#

whmapi1 set_tier tier=11.110.0.103
/scripts/upcp --force

Emergency Mitigation if You Cannot Patch Immediately#

If the upgrade window is delayed, restrict network reachability to the cPanel and WHM service ports.

CSF approach: Remove ports 2082, 2083, 2086, 2087, 2095, 2096 from TCP_IN in /etc/csf/csf.conf, then reload:

csf -r

Service-stop approach: Disable the vulnerable daemons entirely:

whmapi1 configureservice service=cpsrvd enabled=0 monitored=0
whmapi1 configureservice service=cpdavd enabled=0 monitored=0
/scripts/restartsrv_cpsrvd --stop
/scripts/restartsrv_cpdavd --stop

These are stop-gap measures. Patch as soon as the maintenance window allows.

Indicators of Compromise#

Patching alone does not undo a prior breach. Because exploitation has been observed since at least February 23, 2026, every host should be audited.

Forged Session Fingerprint#

Look inside /var/cpanel/sessions/raw/ for files containing these hallmark forged attributes:

pass=x
user=root
hasroot=1
tfa_verified=1
successful_internal_auth_with_timestamp=9999999999
origin_as_string=address=127.0.0.1,app=whostmgrd,method=badpass
token_denied=1

A legitimate preauth session never contains pass=, hasroot=1, or successful_internal_auth_with_timestamp.

grep 'method=badpass' /usr/local/cpanel/logs/login_log

SessionScribe Scanners by R-fx Networks#

A non-destructive remote probe and an on-host IoC scanner are publicly available. Exit codes: 0 = patched and clean, 1 = vulnerable, 2 = inconclusive, 4 = compromised.

curl -fsSLO https://sh.rfxn.com/sessionscribe-remote-probe.sh
bash sessionscribe-remote-probe.sh --target YOUR_SERVER_IP --quiet --no-color

curl -fsSLO https://sh.rfxn.com/sessionscribe-ioc-scan.sh
bash sessionscribe-ioc-scan.sh --jsonl --quiet

Post-Patch Hardening#

A patched but previously exposed host should be treated as potentially compromised. Recommended actions:

Rotate every WHM root, reseller, and administrator password.

Revoke and regenerate every WHM API token.

Force a global session reset to clear all existing sessions:

rm -f /var/cpanel/sessions/raw/* /var/cpanel/sessions/cache/*

Diff /etc/passwd, cron jobs, and authorized_keys against your last known-good backup.

Enable proxy subdomains so administrative access flows through port 443 rather than 2083:

whmapi1 set_tweaksetting key=proxysubdomains value=1
/scripts/proxydomains add

Deploy SessionScribe-aware ModSecurity rules from R-fx Networks and reload Apache.

Restrict direct exposure of cpsrvd ports to a management subnet only.

Why This Matters#

The combination of an authentication bypass requiring no user interaction, no privilege requirement, and approximately 1.5 million internet-exposed instances makes CVE-2026-41940 one of the highest-impact hosting-layer vulnerabilities of the year. A single compromised cPanel host typically holds dozens to hundreds of customer websites, every associated database, and every mailbox, making it a near-perfect supply-chain pivot point.

Major hosting providers including Namecheap, KnownHost, HostPapa, and InMotion preemptively blocked TCP/2083 and TCP/2087 ahead of patching, accepting customer-facing downtime as the lesser cost. Independent administrators should act with the same urgency.

Timeline#

February 23, 2026 - Earliest observed in-the-wild exploitation

Mid-April 2026 - Vulnerability privately disclosed to cPanel

April 28, 2026 - Public advisory and patches released

April 30, 2026 - watchTowr Labs publishes PoC; CISA adds CVE-2026-41940 to KEV; Shadowserver records 44,000 unique scanning IPs

Conclusion#

If you operate any cPanel or WHM host, the action items are non-negotiable: patch to the build matching your tier, rotate credentials, scan for indicators of compromise, and harden network exposure of the administrative ports. The exploitation window opened more than two months before disclosure, so a clean version string alone is not proof of a clean host.

References#

WebPros / cPanel official security advisory (April 28, 2026)

watchTowr Labs - technical deep-dive and proof-of-concept

R-fx Networks - SessionScribe reverse engineering and detection tooling

Rapid7 Emergent Threat Report - CVE-2026-41940

NVD - CVE-2026-41940 detail

CISA Known Exploited Vulnerabilities Catalog

Help Net Security - cPanel zero-day exploited before patch

BleepingComputer - cPanel WHM emergency update

The Hacker News - Critical cPanel Authentication Vulnerability

Authored by Jacob Strix, CEO and Security Researcher at Egnworks.