Critical Authentication Bypass in cPanel & WHM (CVE-2026-41940)

On 28 April 2026, cPanel and its WebHost Manager (WHM) were found to contain a CRLF-injection flaw that bypasses authentication. By injecting carriage-return/line-feed characters into the login flow, an attacker can craft a malformed `whostmgrsession` cookie, write arbitrary session properties (e.g., `user=root`), and gain full administrative control of the server.

Critical cPanel Authentication Vulnerability Identified — Update Your Server Immediately

The flaw affects all cPanel/WHM versions after 11.40, including DNSOnly. Patches cover eight builds (11.86.0.41-11.136.0.5) and WP Squared 136.1.7. More than 2 million cPanel instances are reachable online; many lack auto-update. WHM’s root privileges let an exploit read accounts, modify files, install malware, create backdoors, steal credentials, and pivot. CVSS 9.8.

Critical cPanel Authentication Vulnerability Identified — Update Your Server Immediately

cPanel advises running `/scripts/upcp --force`, confirming the version, restarting services, and blocking ports 2083-2096 if patches cannot be applied. Namecheap blocked ports 2083/2087, limited cPanel/WHM access, and will apply the patch as soon as released.

Critical cPanel Authentication Vulnerability Identified — Update Your Server Immediately

KnownHost CEO Daniel Pearson warned the flaw “has absolutely been used in the wild” for at least 30 days. watchTowr’s Benjamin Harris called it “an unauthenticated authentication bypass” and said major providers “pulled the emergency brake” by fire-walling ports. Hadrian noted that WHM’s root access makes cPanel compromise far more severe than a single site breach.

Critical cPanel Authentication Vulnerability Identified — Update Your Server Immediately

Reddit users posted evidence of exploitation. watchTowr’s script scans `/var/cpanel/sessions` for combined `token_denied`/`cp_security_token` flags, pre-auth `tfa_verified` without origin, and multiline passwords. An alert flagged IP 100.96.3.23 injecting a malicious session token.

cPanel CVE-2026-41940 Auth Bypass Flaw: Patch Now Fast!

cPanel has not released detailed technical data; third-party advisories (Rapid7, watchTowr) describe the CRLF injection. The number of compromised servers and auto-update coverage remain unknown.

Critical cPanel Authentication Vulnerability Identified — Update Your Server Immediately

• “If your server is not running a supported version of cPanel that is eligible for this update, it is highly recommended that you work toward updating your server as soon as possible, as it may also be affected,” — cPanel

Critical cPanel Authentication Vulnerability Identified — Update Your Server Immediately

• “Our team is actively monitoring the situation and will apply the official patch across all supported servers as soon as it becomes available.” — Namecheap

cPanel CVE-2026-41940 Auth Bypass Flaw: Patch Now Fast!

• “this has absolutely been used in the wild, and has been seen at least for the last 30 days if not longer.” — Daniel Pearson, CEO, KnownHost

Critical cPanel Authentication Vulnerability Identified — Update Your Server Immediately

• “Compromise of cPanel is materially different from the compromise of a single customer website. WHM grants root administrative access to the server,” — Hadrian, security researcher

Critical cPanel Authentication Vulnerability Identified — Update Your Server Immediately

cPanel will keep issuing patches for any remaining vulnerable builds and monitor abuse reports. Providers should apply updates, enforce firewall blocks where patches lag, and run the detection script to purge compromised sessions. Ongoing collaboration with security researchers aims to refine remediation guidance and track further exploitation of CVE-2026-41940.

cPanel CVE-2026-41940 Auth Bypass Flaw: Patch Now Fast!