hypeorhack
← back

CVE-2026-41940

CRITICAL · 9.8 KEV EPSS 28.4%
hype ACTIVE HACK · 94 hack

Active in-the-wild exploitation, KEV-listed, confirmed Mirai/ransomware campaigns, mass scanning.

What: Authentication bypass in cPanel/WHM versions after 11.40 allowing unauthenticated remote root access (CVSS 9.8 CRITICAL, EPSS 0.96).

Why it matters: KEV-listed 2026-04-30. Active in-the-wild exploitation confirmed within 24 hours of disclosure. Censys reports 80% of new malicious hosts linked to cPanel; Shadowserver observed 44K+ compromised IPs scanning honeypots. Mirai variants and ".sorry" ransomware campaigns already active. ~1.5M cPanel instances exposed online.

Where it's seen: Security research teams (Censys, Shadowserver, DFIR analysts) publishing mass-compromise metrics and botnet/ransomware attribution. Hosting providers (Hostao) taking services offline. Global CERT advisories issued. Patch available since 2026-04-28.

RISK: CRITICAL — KEV-listed, 44K+ compromised IPs, mass botnet/ransomware exploitation within 24h, 1.5M exposed instances.

Generated by claude-haiku-4-5 from public posts and authoritative metadata. AI can make mistakes — verify against vendor advisories before acting. 5/2/2026, 1:53:03 PM

AttackerKB

view on attackerkb.com →

cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

Public PoCs on GitHub 20 repos

Page 1 of 4

Articles & coverage 15 articles

  • Exploit for CVE-2026-41940 - Vulners.com

    Vuln critique cPanel/WHM: injection CRLF dans Basic, contournement d'authentification et accès root. Show more.

  • CISA KEV: CVE-2026-41940 Active Exploitation Hits cPanel & WHM Mgmt Plane | Windows Forum

    # CISA KEV: CVE-2026-41940 Active Exploitation Hits cPanel & WHM Mgmt Plane. : cisa kev cpanel whm shared hosting security vulnerability remediation. CISA added CVE-2026-41940, a critical missing-authentication vulnerability in WebPros cPanel & WHM and WP Squared, to its Known Exploited Vulnerabilities Catalog on April 30, 2026, after evidence showed the flaw was already being exploited in

  • CVE-2026-41940 Explained: The cPanel & WHM Authentication ...

    # CVE-2026-41940 Explained: The cPanel & WHM Authentication Bypass That Hit 1.5M Servers. **TL;DR** — CVE-2026-41940 is a pre-authentication remote auth bypass in cPanel & WHM (CVSS 9.8). It chains a **CRLF injection** in the session writer with an **encryption-skip** triggered by a malformed cookie, then uses a quirk in how cPanel caches sessions to "promote" the injection into a privileged login

  • CVE-2026-41940: A Critical Authentication Bypass in cPanel

    cPanel disclosed a critical authentication bypass vulnerability in all currently supported versions on April 28, 2026. The vulnerability is a session-file manipulation attack through CRLF injection. When cpsrvd re-parses that file, the injected lines become top-level session entries — including user=root, hasroot=1, tfa\_verified=1, a chosen cp\_security\_token, and a fresh successful\_internal\_a

  • CVE-2026-41940: cPanel & WHM Authentication Bypass - Rapid7

    # CVE-2026-41940: cPanel & WHM Authentication Bypass. On April 28, 2026, cPanel issued a security update to fix a critical vulnerability affecting the cPanel & WHM and WP Squared products. In the cPanel release notes, the bug was described as "an issue with session loading and saving." CVE-2026-41940, the identifier subsequently assigned on April 29, 2026, has a CVSS score of 9.8 and allows unauth

Page 1 of 3
› NVD details 1 CWE ·1 vendor · 7 refs expand

Description

cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

Weaknesses

Vendors

  • cpanel

Products

  • cpanel
  • whm
  • wp_squared

References

Patches & fixes · 2
Exploits & PoCs · 1
Vendor advisories · 1
Third-party advisories · 3

Top posts driving the trend