Critical cPanel & WHM Auth Bypass Exploited for Server Takeover

WebPros cPanel disclosed and patched a critical authentication bypass flaw in cPanel & WHM and WP Squared, now tracked as CVE-2026-41940 with a CVSS 9.8 score. The bug affects all supported cPanel & WHM versions after 11.40 prior to fixed releases, and reporting indicates some unsupported versions are likely vulnerable as well. Researchers said the issue stems from improper session handling tied to a CRLF injection in the login flow, allowing unauthenticated remote attackers to poison session data and gain administrator or root-level access to exposed hosting control panels. cPanel released emergency updates across supported branches, published detection guidance, and advised administrators to force updates, restart cpsrvd, and investigate session files and logs for signs of compromise.

Multiple sources reported the flaw was actively exploited in the wild before patches were issued, with hosting providers such as Namecheap and KnownHost taking emergency action by restricting access to management ports like 2083 and 2087 while deploying fixes. CISA added CVE-2026-41940 to its Known Exploited Vulnerabilities catalog and ordered federal agencies to remediate quickly, while national cyber agencies in Canada, Austria, and Belgium also warned of the risk. Public technical analysis, proof-of-concept code, and exploit tooling released after disclosure increased the likelihood of broad opportunistic attacks against internet-exposed cPanel systems, which researchers estimated number in the hundreds of thousands to more than a million, raising the risk of website compromise, credential theft, ransomware, phishing, and multi-tenant hosting breaches.