Summary
A critical authentication bypass vulnerability in cPanel and WebHost Manager (WHM), tracked as CVE-2026-41940 (CVSS 9.8), has been aggressively exploited in the wild, with confirmed compromises of over 40,000 servers. The flaw allows unauthenticated remote attackers to gain root-level administrative access by exploiting a CRLF injection in the login and session loading processes.
Attackers manipulate the whostmgrsession cookie to inject arbitrary session attributes — including user=root — into their session file, completely bypassing authentication. Exploitation grants full control over the WHM admin interface, all hosted cPanel accounts, websites, databases, and email. Reports indicate that exploitation may have begun as early as February 2026, months before the vulnerability was publicly disclosed. CISA has added CVE-2026-41940 to its Known Exploited Vulnerabilities catalog.
Compromised servers have shown multi-layered persistence: UID-0 backdoor accounts, unauthorized SSH keys, fake cPanel reseller accounts, PHP webshells distributed across customer directories, and in some cases deployment of “.sorry” ransomware. With cPanel powering an estimated 70 million domains globally, the blast radius is enormous.
Source
Rapid7 — CVE-2026-41940 Analysis · Horizon3.ai · Arctic Wolf
Commentary
This is one of the most impactful web hosting vulnerabilities in recent memory. A pre-auth root bypass in the world’s most popular hosting control panel — affecting every supported version after 11.40 — is about as bad as it gets. The fact that exploitation began months before public disclosure, and that 40,000+ servers have already fallen, suggests that many hosting providers are running significantly behind on patching.
The layered persistence techniques observed — UID-0 accounts, SSH keys, reseller accounts, distributed webshells — indicate that attackers are not just popping boxes for ransomware; they are building durable access for long-term exploitation and lateral movement. If you run cPanel in any capacity, patching is not optional. Block ports 2083, 2087, 2095, and 2096 from the public internet immediately if you have not already, and run the vendor-provided compromise assessment scripts.