Hi there, guest! If you have an account, then please sign in or register in order to see more.
cPanel & WHM Auth Bypass (CVE-2026-41940)
Updated 7 October 2026
8 min read
ESAGAMES Team
In spring 2026, cPanel disclosed CVE-2026-41940 - a critical authentication-bypass flaw (CVSS 9.8) in cPanel & WHM that is actively exploited in the wild and has been added to CISA's Known Exploited Vulnerabilities catalog. If you run cPanel/WHM yourself, this is an emergency-patch situation. Here's what it is and what to do.
Quick answer
CVE-2026-41940 is a critical (CVSS 9.8) authentication bypass in cPanel & WHM, actively exploited in the wild and listed in CISA's Known Exploited Vulnerabilities catalog. It affects every version after 11.40 plus WP Squared. If you run cPanel/WHM yourself, update to a patched build immediately and check for signs of compromise.
What is CVE-2026-41940?
It's a CRLF-injection authentication bypass in cPanel & WHM's login and session handling. By manipulating the whostmgrsession cookie - omitting an expected segment - an attacker can inject properties such as user=root into a session file and be treated as an authenticated administrator. From there, admin access leads to remote code execution on the server. No credentials required.
With a CVSS of 9.8 and cPanel powering more than 70 million domains, this is about as bad as web-hosting vulnerabilities get. Reports tie active exploitation to Mirai botnet variants and a ransomware strain, with tens of thousands of servers reported compromised.
Am I affected?
Almost certainly, if you run your own cPanel: the flaw affects every version after 11.40 (released back in 2013), plus all versions of WP Squared. That covers essentially every modern install. You are only safe if you are on one of the patched builds below.
The fixed versions
cPanel released patches around 30 April 2026. Update to at least the fixed build in your tier:
If your server auto-updates cPanel (the default), you may already be patched - but verify the running version now rather than assume.
What to do right now
Update cPanel & WHM immediately to a fixed version - treat it as an emergency, not the next maintenance window.
Assume possible compromise if you were unpatched and internet-facing: this has reportedly been exploited as a zero-day since as early as February 2026.
Look for signs of intrusion: unexpected WHM admin logins, new root or reseller accounts, unknown cron jobs, modified files, or outbound traffic to unfamiliar hosts.
Rotate credentials (WHM root, API tokens and any passwords stored on the box) after patching.
cPanel disclosed more flaws in the same window - including CVE-2026-29202 (CVSS 8.8, Perl code injection via the create_user API), CVE-2026-29203 (CVSS 8.8, unsafe symlink handling) and CVE-2026-29201 (arbitrary file read). Staying on the latest patched build closes all of them. The lesson is the usual one: a control panel exposed to the internet must be patched fast and continuously.
Why managed hosting takes this off your plate
One big advantage of managed shared or reseller hosting is that the provider patches the control panel for you, usually within hours of a critical release, and watches for exploitation. If you'd rather not be the one racing a CVSS-9.8 clock at 2am, that is a strong reason to run on managed hosting - see how to choose a web host and securing the sites on top of it.
A CVSS-9.8 auth bypass in software running 70 million domains is a patch-tonight event. Update cPanel now, then check for signs you were already hit.
Let us patch the panel for you
ESAGAMES managed web hosting keeps the control panel patched and monitored, so critical CVEs like this are handled before they ever reach you.
It is a critical authentication-bypass vulnerability in cPanel & WHM, rated CVSS 9.8 and disclosed in spring 2026. It is actively exploited in the wild and has been added to CISA's Known Exploited Vulnerabilities catalog, making it an emergency-patch situation.
What should I do if I run cPanel/WHM?
Patch immediately — given active exploitation this is not a "next maintenance window" issue. After updating, review accounts, sessions and logs for signs of unauthorised access, and rotate credentials if anything looks suspicious.
Am I affected if I use shared hosting with cPanel?
The patching responsibility sits with your host rather than you. On managed hosting the provider should have applied the fix promptly — if you are unsure, it is entirely reasonable to ask them to confirm.
BepInEx, QoL, building and content mods — the best Valheim mods to run on a dedicated server this year, with a starter pack and sync rules that stop join failures.
Super Structures, Spyglass, Cryopods and more — the best ARK mods to run on a server this year, with load order and the ASE-vs-ASA differences that trip people up.
SourceMod does not support CS2 — not in 2026, not through a bridge. Here is what actually replaced it.
Action required
Let's talk about privacy.
We use essential cookies to keep checkout, login sessions and security flows working. Optional cookies help us understand performance, remember interface choices and enable external support widgets only when you allow them.
