cPanel CVE-2026-41940 Exploited on Thousands of Servers

A critical authentication bypass vulnerability in cPanel and WebHost Manager (WHM), tracked as CVE-2026-41940, has been actively exploited by multiple threat actors since late February 2026, compromising tens of thousands of servers worldwide before patches were released on April 28, 2026.

The flaw, which carries a CVSS score of 9.8, allows unauthenticated remote attackers to gain root-level administrative access through a chain of weaknesses in the cpsrvd daemon's session handling. Attackers manipulate a malformed HTTP Authorization header with carriage return line feed (CRLF) sequences and a truncated session cookie to inject unsanitized data into session files stored on disk. This promotes the session to a fully authenticated root user, bypassing password checks and two-factor authentication. The U.S. Cybersecurity and Infrastructure Security Agency added the vulnerability to its Known Exploited Vulnerabilities catalog, directing federal agencies to patch within days.

Exploitation spiked after public disclosure and the release of proof-of-concept code, with The Shadowserver Foundation detecting about 44,000 unique IP addresses scanning, exploiting, or brute-forcing cPanel...