Skip to content

KEV: cPanel & WHM / WP2 authentication bypass (CVE-2026-41940)

Signal: CISA added CVE-2026-41940 to KEV on 2026-04-30. The issue affects WebPros cPanel & WHM and WP Squared and is reported as exploited in the wild. Treat exposed management ports as emergency patch scope.

What it is

CVE-2026-41940 is an unauthenticated authentication bypass in cPanel & WHM / WP Squared session loading and saving. Public analysis describes a CRLF/session-file injection path in cpsrvd: attacker-controlled session material can be written before authentication, then reloaded as an administrator-level session.

Impact is high because WHM is a root/admin control plane for hosted sites, databases, DNS, and server configuration. Successful exploitation can become full hosting-account or server control, and CISA KEV means defenders should assume real-world exploitation pressure.

Affected versions reported by Rapid7/vendor references include cPanel & WHM versions after 11.40 before fixed builds in supported branches, and WP Squared before 136.1.7. Confirm exact fixed versions against vendor guidance for the deployed branch.

References: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json, https://support.cpanel.net/hc/en-us/articles/40073787579671-Security-CVE-2026-41940-cPanel-WHM-WP2-Security-Update-04-28-2026, https://www.rapid7.com/blog/post/etr-cve-2026-41940-cpanel-whm-authentication-bypass/

Triage

  1. Inventory internet-facing cPanel & WHM / WHM (2087) and cPanel (2083) endpoints, plus WP Squared instances.
  2. Prioritize shared hosting, reseller, DNSOnly, and management-plane hosts where compromise would cascade across customer sites.
  3. Verify exact branch/build, not only major version. All versions after 11.40 were reported affected until fixed branch releases.
  4. Review recent successful WHM/cPanel logins, new sessions, created accounts, package changes, DNS changes, webshell indicators, and unexpected root/admin actions since at least late February 2026.

Mitigation

  • Patch immediately to the vendor-fixed version for the installed branch; use emergency update channels where appropriate.
  • If patching is not immediately possible, restrict cPanel/WHM management ports to trusted admin IPs or temporarily block external access, but treat this as a short-lived containment control, not a fix.
  • Rotate credentials and API tokens after patching if logs or exposure suggest possible exploitation.
  • For managed hosting fleets, notify downstream site owners if there is evidence of unauthorized access or file/database modification.

Hunt ideas

  • Search cPanel/WHM access logs for anomalous unauthenticated login flows, malformed Basic Authorization headers, unexpected whostmgrsession values, or CRLF-like artifacts.
  • Look for new root-level WHM sessions, newly created cPanel users, altered packages/features, password resets, changed contact emails, SSH key additions, and suspicious cron jobs.
  • Compare web roots and account home directories for newly modified PHP/CGI files, webshell patterns, and unfamiliar plugins uploaded around the exposure window.
  • Inspect DNS zone, mail forwarder, database user, and reseller privilege changes after suspicious WHM activity.

Durable lesson

Hosting control panels are identity and infrastructure control planes. Session serialization must treat all pre-auth input as hostile, and exposed admin panels need fast branch-aware patching, network allowlisting, and post-patch compromise review whenever KEV confirms exploitation.