cPanel & WHM Authentication Bypass (CVE-2026-41940): Patch Now

In spring 2026, cPanel disclosed CVE-2026-41940 - a critical authentication-bypass flaw (CVSS 9.8) in cPanel & WHM that is actively exploited in the wild and has been added to CISA's Known Exploited Vulnerabilities catalog. If you run cPanel/WHM yourself, this is an emergency-patch situation. Here's what it is and what to do.

What is CVE-2026-41940?

It's a CRLF-injection authentication bypass in cPanel & WHM's login and session handling. By manipulating the whostmgrsession cookie - omitting an expected segment - an attacker can inject properties such as user=root into a session file and be treated as an authenticated administrator. From there, admin access leads to remote code execution on the server. No credentials required.

With a CVSS of 9.8 and cPanel powering more than 70 million domains, this is about as bad as web-hosting vulnerabilities get. Reports tie active exploitation to Mirai botnet variants and a ransomware strain, with tens of thousands of servers reported compromised.

Am I affected?

Almost certainly, if you run your own cPanel: the flaw affects every version after 11.40 (released back in 2013), plus all versions of WP Squared. That covers essentially every modern install. You are only safe if you are on one of the patched builds below.

The fixed versions

cPanel released patches around 30 April 2026. Update to at least the fixed build in your tier:

• 11.136.0.5, 11.134.0.20, 11.132.0.29, 11.130.0.19, 11.126.0.54, 11.118.0.63, 11.110.0.97 or 11.86.0.41 (WP Squared: 136.1.7).

If your server auto-updates cPanel (the default), you may already be patched - but verify the running version now rather than assume.

What to do right now

• Update cPanel & WHM immediately to a fixed version - treat it as an emergency, not the next maintenance window.
• Assume possible compromise if you were unpatched and internet-facing: this has reportedly been exploited as a zero-day since as early as February 2026.
• Look for signs of intrusion: unexpected WHM admin logins, new root or reseller accounts, unknown cron jobs, modified files, or outbound traffic to unfamiliar hosts.
• Rotate credentials (WHM root, API tokens and any passwords stored on the box) after patching.
• If you find evidence of a breach, follow incident-response basics - see what to do if someone gets root on your VPS.

Don't stop at one CVE

cPanel disclosed more flaws in the same window - including CVE-2026-29202 (CVSS 8.8, Perl code injection via the create_user API), CVE-2026-29203 (CVSS 8.8, unsafe symlink handling) and CVE-2026-29201 (arbitrary file read). Staying on the latest patched build closes all of them. The lesson is the usual one: a control panel exposed to the internet must be patched fast and continuously.

Why managed hosting takes this off your plate

One big advantage of managed shared or reseller hosting is that the provider patches the control panel for you, usually within hours of a critical release, and watches for exploitation. If you'd rather not be the one racing a CVSS-9.8 clock at 2am, that is a strong reason to run on managed hosting - see how to choose a web host and securing the sites on top of it.

A CVSS-9.8 auth bypass in software running 70 million domains is a patch-tonight event. Update cPanel now, then check for signs you were already hit.