erroneo.us
Search all guides⌘K

Security Digest · Apr 28, 2026 · Vulnerability · Other

cPanel & WHM CVE-2026-41940: Exploited Login Auth Bypass

Pre-auth root access to cPanel & WHM and WP2, a zero-day since Feb 2026 later used for ransomware. Fixed Apr 28; verify the build and run the IOC script.

Published By erroneo.us Security Desk · Updated 3 min read7 sources

Our verdict

Check exposure

Nearly every cPanel server should have auto-updated by early May 2026, but the bug was a zero-day for two months and then mass-exploited for ransomware, so confirm the build and run cPanel's IOC script; any server still unpatched should be presumed compromised.

Who must act: Every cPanel & WHM, DNSOnly or WP Squared operator, most urgently servers with updates disabled or pinned, CentOS/CloudLinux 6-7 hosts, and any server that exposed ports 2083/2087/2095/2096 before patching.

Who can relax: Hosting customers on managed providers that confirmed patching and IOC scans; plain cPanel end users have nothing to install themselves.

Affected
cPanel & WHM (including DNSOnly) 11.40 and later before the fixed build for each tier
WP Squared before 136.1.7
CentOS 6 / CloudLinux 6 servers on 110.0.50
Fixed in
cPanel & WHM 11.86.0.41, 11.94.0.28, 11.102.0.39, 11.110.0.97, 11.118.0.63, 11.124.0.35, 11.126.0.54, 11.130.0.19, 11.132.0.29, 11.134.0.20, 11.136.0.5 and later
WP Squared 136.1.7
110.0.103 for CentOS 6 / CloudLinux 6
CVSS
9.8 (v3.1, CNA)
EPSS
98.5% (percentile 99.9)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Check the build with /usr/local/cpanel/cpanel -V and compare it to the fixed list for your tier.
  2. If behind, run /scripts/upcp --force and then /scripts/restartsrv_cpsrvd --hard; fix pinned or disabled update settings (CentOS 7/CloudLinux 7: whmapi1 set_tier tier=11.110).
  3. If you cannot update yet, block ports 2083, 2087, 2095 and 2096 and disable service subdomains, or stop cpsrvd and cpdavd.
  4. Run cPanel's ioc_checksessions_files.sh detection script from the advisory on every server.
  5. On any CRITICAL or WARNING finding, reset root and WHM passwords, check cron jobs and SSH keys, and if root was compromised migrate accounts to a clean server or reinstall.

How to check if you are affected or compromised

  • grep -rlE '^hasroot=1' /var/cpanel/sessions/raw/ (hasroot is never written by legitimate code)
  • Sessions in /var/cpanel/sessions/raw/ with origin method=badpass plus successful_*_auth_with_timestamp or tfa_verified=1, or lines that are not key=value
  • /bin/bash ./ioc_checksessions_files.sh (exit code 2 means compromise indicators)
  • find / -xdev -name '*.sorry' and README.md ransom notes mentioning Tox, the marks of the Sorry ransomware

What happened#

On April 28, 2026, cPanel shipped an emergency fix for CVE-2026-41940, an authentication bypass in the login flow of cPanel & WHM (including DNSOnly) and WP Squared. An unauthenticated attacker who can reach the panel gets in, and in WHM that means root on the hosting server. The vendor advisory says every version after 11.40 is affected and credits Sybre Waaijer.

watchTowr's analysis shows a CRLF injection into session files. If the whostmgrsession cookie omits its per-session secret, the pass field is written unencoded to /var/cpanel/sessions/raw/. The Basic-auth handler strips only NUL bytes. An attacker can therefore inject lines such as hasroot=1 and successful_internal_auth_with_timestamp=, which cpsrvd later trusts without checking a password.

This was a zero-day. Hosting provider KnownHost said exploitation began on February 23, 2026, SecurityWeek reports. By May 2, BleepingComputer found the bug being mass-exploited to deploy "Sorry", a Go-based Linux encryptor that appends .sorry and drops README.md notes. It cited Shadowserver counting at least 44,000 compromised IPs running cPanel. CISA added the CVE to KEV on April 30 with a three-day deadline and flags ransomware use.

Who is affected#

Fixed builds per tier are 11.86.0.41, 11.94.0.28, 11.102.0.39, 11.110.0.97, 11.118.0.63, 11.124.0.35, 11.126.0.54, 11.130.0.19, 11.132.0.29, 11.134.0.20 and 11.136.0.5. WP Squared is fixed in 136.1.7. CentOS 6 and CloudLinux 6 hosts on 110.0.50 have 110.0.103. Older builds on those tiers are vulnerable. The CVE record (VulnCheck) scores it CVSS 3.1 9.8 and 4.0 9.3, and NVD shows the same scores. Rapid7 cited about 1.5 million internet-reachable cPanel instances on Shodan.

Do you really need to act?#

Yes, but mostly to verify. cPanel updates itself unless updates are disabled or pinned, so most servers took the fix in late April or early May. Being patched does not mean being clean. The bug was exploited for two months before the fix and mass-exploited right after it. Pinned servers, end-of-life OS tiers and forgotten boxes are the ones most likely to have been hit.

What to do now#

  1. Check the build with /usr/local/cpanel/cpanel -V.
  2. If it is behind, run /scripts/upcp --force and then /scripts/restartsrv_cpsrvd --hard. On CentOS 7 or CloudLinux 7, first run whmapi1 set_tier tier=11.110.
  3. If you cannot update yet, block ports 2083, 2087, 2095 and 2096 and disable service subdomains, or stop cpsrvd and cpdavd, as the advisory describes.
  4. Run cPanel's ioc_checksessions_files.sh from the advisory on every server. Exit code 2 means compromise indicators were found.
  5. On a hit, purge the flagged sessions and reset root and WHM passwords. Audit /var/log/wtmp, cron jobs and SSH keys. If root was compromised, move accounts to a clean server or reinstall the OS and restore from backups.
  6. Going forward, restrict WHM (2087) to admin addresses.

How to tell if you were hit#

Run grep -rlE '^hasroot=1' /var/cpanel/sessions/raw/. cPanel says legitimate code never writes that key. Also look for sessions whose origin_as_string is method=badpass but which carry an auth timestamp or tfa_verified=1, and for lines that are not key=value. The script also matches injected tokens against /usr/local/cpanel/logs/access_log. Session files may be gone months later, so also check for persistence and for *.sorry files.

Timeline#

  • — Earliest exploitation reported by KnownHost.
  • — cPanel publishes the advisory and patched builds.
  • — CVE published, watchTowr analysis released, and a detection script added to the advisory.
  • — CISA adds the CVE to KEV with a May 3 deadline.
  • — Mass exploitation for Sorry ransomware is reported.
  • — Patched builds for the 11.94 and 11.102 tiers are added.

Vulnerability records

  • CVE-2026-41940 · KEV 2026-04-30 · cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. cPanel — Security: CVE-2026-41940 cPanel & WHM / WP2 Security Update 04/28/2026 support.cpanel.net
  2. CVE record — CVE-2026-41940 cve.org
  3. NVD — CVE-2026-41940 nvd.nist.gov
  4. CISA — Known Exploited Vulnerabilities: CVE-2026-41940 cisa.gov
  5. watchTowr Labs — cPanel & WHM authentication bypass (CVE-2026-41940) labs.watchtowr.com

Coverage and analysis

  1. BleepingComputer — Critical cPanel flaw mass-exploited in Sorry ransomware attacks bleepingcomputer.com
  2. SecurityWeek — Critical cPanel & WHM vulnerability exploited as zero-day for months securityweek.com