---
title: "cPanel & WHM CVE-2026-41940: Exploited Login Auth Bypass"
url: https://erroneo.us/security/briefs/cpanel-whm-cve-2026-41940-auth-bypass/
description: "Pre-auth root access to cPanel & WHM and WP2, a zero-day since Feb 2026 later used for ransomware. Fixed Apr 28; verify the build and run the IOC script."
type: security-brief
section: "Security Digest"
date_published: 2026-04-28
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2026-41940"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# cPanel & WHM CVE-2026-41940: Exploited Login Auth Bypass

**Verdict: Check exposure.** Nearly every cPanel server should have auto-updated by early May 2026, but the bug was a zero-day for two months and then mass-exploited for ransomware, so confirm the build and run cPanel's IOC script; any server still unpatched should be presumed compromised.

- **Who must act:** Every cPanel & WHM, DNSOnly or WP Squared operator, most urgently servers with updates disabled or pinned, CentOS/CloudLinux 6-7 hosts, and any server that exposed ports 2083/2087/2095/2096 before patching.
- **Who can relax:** Hosting customers on managed providers that confirmed patching and IOC scans; plain cPanel end users have nothing to install themselves.
- **Affected:** cPanel & WHM (including DNSOnly) 11.40 and later before the fixed build for each tier; WP Squared before 136.1.7; CentOS 6 / CloudLinux 6 servers on 110.0.50
- **Fixed:** cPanel & WHM 11.86.0.41, 11.94.0.28, 11.102.0.39, 11.110.0.97, 11.118.0.63, 11.124.0.35, 11.126.0.54, 11.130.0.19, 11.132.0.29, 11.134.0.20, 11.136.0.5 and later; WP Squared 136.1.7; 110.0.103 for CentOS 6 / CloudLinux 6
- **CVEs:** CVE-2026-41940
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Check the build with /usr/local/cpanel/cpanel -V and compare it to the fixed list for your tier.
2. If behind, run /scripts/upcp --force and then /scripts/restartsrv_cpsrvd --hard; fix pinned or disabled update settings (CentOS 7/CloudLinux 7: whmapi1 set_tier tier=11.110).
3. If you cannot update yet, block ports 2083, 2087, 2095 and 2096 and disable service subdomains, or stop cpsrvd and cpdavd.
4. Run cPanel's ioc_checksessions_files.sh detection script from the advisory on every server.
5. On any CRITICAL or WARNING finding, reset root and WHM passwords, check cron jobs and SSH keys, and if root was compromised migrate accounts to a clean server or reinstall.

### How to check if you are affected

- grep -rlE '^hasroot=1' /var/cpanel/sessions/raw/ (hasroot is never written by legitimate code)
- Sessions in /var/cpanel/sessions/raw/ with origin method=badpass plus successful_*_auth_with_timestamp or tfa_verified=1, or lines that are not key=value
- /bin/bash ./ioc_checksessions_files.sh (exit code 2 means compromise indicators)
- find / -xdev -name '*.sorry' and README.md ransom notes mentioning Tox, the marks of the Sorry ransomware

## What happened

On April 28, 2026, cPanel shipped an emergency fix for CVE-2026-41940, an authentication bypass in the login flow of cPanel & WHM (including DNSOnly) and WP Squared. An unauthenticated attacker who can reach the panel gets in, and in WHM that means root on the hosting server. The [vendor advisory](https://support.cpanel.net/hc/en-us/articles/40073787579671-Security-CVE-2026-41940-cPanel-WHM-WP2-Security-Update-04-28-2026) says every version after 11.40 is affected and credits Sybre Waaijer.

[watchTowr's analysis](https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/) shows a CRLF injection into session files. If the `whostmgrsession` cookie omits its per-session secret, the `pass` field is written unencoded to `/var/cpanel/sessions/raw/`. The Basic-auth handler strips only NUL bytes. An attacker can therefore inject lines such as `hasroot=1` and `successful_internal_auth_with_timestamp=`, which cpsrvd later trusts without checking a password.

This was a zero-day. Hosting provider KnownHost said exploitation began on February 23, 2026, [SecurityWeek reports](https://www.securityweek.com/critical-cpanel-whm-vulnerability-exploited-as-zero-day-for-months/). By May 2, [BleepingComputer](https://www.bleepingcomputer.com/news/security/critrical-cpanel-flaw-mass-exploited-in-sorry-ransomware-attacks/) found the bug being mass-exploited to deploy "Sorry", a Go-based Linux encryptor that appends `.sorry` and drops `README.md` notes. It cited Shadowserver counting at least 44,000 compromised IPs running cPanel. CISA added the CVE to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41940) on April 30 with a three-day deadline and flags ransomware use.

## Who is affected

Fixed builds per tier are 11.86.0.41, 11.94.0.28, 11.102.0.39, 11.110.0.97, 11.118.0.63, 11.124.0.35, 11.126.0.54, 11.130.0.19, 11.132.0.29, 11.134.0.20 and 11.136.0.5. WP Squared is fixed in 136.1.7. CentOS 6 and CloudLinux 6 hosts on 110.0.50 have 110.0.103. Older builds on those tiers are vulnerable. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-41940) (VulnCheck) scores it CVSS 3.1 9.8 and 4.0 9.3, and [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-41940) shows the same scores. Rapid7 cited about 1.5 million internet-reachable cPanel instances on Shodan.

## Do you really need to act?

Yes, but mostly to verify. cPanel updates itself unless updates are disabled or pinned, so most servers took the fix in late April or early May. Being patched does not mean being clean. The bug was exploited for two months before the fix and mass-exploited right after it. Pinned servers, end-of-life OS tiers and forgotten boxes are the ones most likely to have been hit.

## What to do now

1. Check the build with `/usr/local/cpanel/cpanel -V`.
2. If it is behind, run `/scripts/upcp --force` and then `/scripts/restartsrv_cpsrvd --hard`. On CentOS 7 or CloudLinux 7, first run `whmapi1 set_tier tier=11.110`.
3. If you cannot update yet, block ports 2083, 2087, 2095 and 2096 and disable service subdomains, or stop `cpsrvd` and `cpdavd`, as the advisory describes.
4. Run cPanel's `ioc_checksessions_files.sh` from the advisory on every server. Exit code 2 means compromise indicators were found.
5. On a hit, purge the flagged sessions and reset root and WHM passwords. Audit `/var/log/wtmp`, cron jobs and SSH keys. If root was compromised, move accounts to a clean server or reinstall the OS and restore from backups.
6. Going forward, restrict WHM (2087) to admin addresses.

## How to tell if you were hit

Run `grep -rlE '^hasroot=1' /var/cpanel/sessions/raw/`. cPanel says legitimate code never writes that key. Also look for sessions whose `origin_as_string` is `method=badpass` but which carry an auth timestamp or `tfa_verified=1`, and for lines that are not `key=value`. The script also matches injected tokens against `/usr/local/cpanel/logs/access_log`. Session files may be gone months later, so also check for persistence and for `*.sorry` files.

## Timeline

- Feb 23, 2026 — Earliest exploitation reported by KnownHost.
- Apr 28, 2026 — cPanel publishes the advisory and patched builds.
- Apr 29, 2026 — CVE published, watchTowr analysis released, and a detection script added to the advisory.
- Apr 30, 2026 — CISA adds the CVE to KEV with a May 3 deadline.
- May 2, 2026 — Mass exploitation for Sorry ransomware is reported.
- May 5, 2026 — Patched builds for the 11.94 and 11.102 tiers are added.

## Sources

1. [cPanel — Security: CVE-2026-41940 cPanel & WHM / WP2 Security Update 04/28/2026](https://support.cpanel.net/hc/en-us/articles/40073787579671-Security-CVE-2026-41940-cPanel-WHM-WP2-Security-Update-04-28-2026)
2. [CVE record — CVE-2026-41940](https://www.cve.org/CVERecord?id=CVE-2026-41940)
3. [NVD — CVE-2026-41940](https://nvd.nist.gov/vuln/detail/CVE-2026-41940)
4. [CISA — Known Exploited Vulnerabilities: CVE-2026-41940](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41940)
5. [watchTowr Labs — cPanel & WHM authentication bypass (CVE-2026-41940)](https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/)
6. [BleepingComputer — Critical cPanel flaw mass-exploited in Sorry ransomware attacks](https://www.bleepingcomputer.com/news/security/critrical-cpanel-flaw-mass-exploited-in-sorry-ransomware-attacks/)
7. [SecurityWeek — Critical cPanel & WHM vulnerability exploited as zero-day for months](https://www.securityweek.com/critical-cpanel-whm-vulnerability-exploited-as-zero-day-for-months/)

---
Source page: https://erroneo.us/security/briefs/cpanel-whm-cve-2026-41940-auth-bypass/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt