Critical Vulnerability in cPanel and WHM: What You Need to Know

In early 2026, one of the most severe vulnerabilities in cPanel & WHM’s history was disclosed — the hosting management platform that powers tens of millions of websites worldwide. The flaw allowed attackers to gain full root access to servers without any valid login credentials.

 

 

 

What is CVE-2026-41940

The vulnerability, tracked as CVE-2026-41940, received the maximum CVSS score — 9.8 out of 10.0. It affects cpsrvd, the daemon that serves the cPanel, WHM, and Webmail interfaces on ports 2082/2083/2086/2087/2095/2096.

Technically, the issue is a combination of two weaknesses:

• A CRLF injection in the handling of the Basic Authorization header during the login process, which allows arbitrary lines to be injected into the server’s session file.
• A race condition between the session’s temporary text file and its JSON cache — attackers could insert a value such as user=root before the system validated and sanitized the data.

The result: an attacker obtains a session with administrator (root) privileges without ever going through a genuine authentication process.

 

 

 

 

 

 

Scope of the Problem

• All supported versions of cPanel & WHM after 11.40 are affected, as well as the WP Squared module.
• According to Shodan telemetry cited by Rapid7, the number of exposed, publicly reachable instances is close to 1.5 million.
• Investigation shows the vulnerability had been actively exploited as a zero-day since late February 2026 — nearly two months before the official disclosure on April 28, 2026.
• Hosting providers such as Namecheap, hosting.com, KnownHost, HostPapa, and InMotion Hosting responded rapidly, temporarily blocking network-level access to cPanel/WHM ports until the patch could be applied.
  
  

What a Successful Attack Enables

Upon successful exploitation, an attacker gains full administrative control, which means they can:

• read and modify all hosted accounts and databases;
• create backdoor accounts for persistent access;
• install malware or ransomware;
• redirect traffic or intercept email communications;
• pivot laterally into other systems on the client’s network.

 

Patch and Recommended Actions

cPanel released an emergency patch just hours after the issue was disclosed:

1. Update immediately to cPanel & WHM 11.136.0.5 or later, and WP Squared 136.1.7 or later.
2. Restart cpsrvd after updating (/scripts/restartsrv_cpsrvd) — the update alone is not sufficient if the service isn’t reloaded.
3. Verify that automatic updates are enabled — servers with auto-update disabled or a pinned version will not patch themselves.
4. Restrict access to administrative ports (2083, 2087) via firewall to trusted IP addresses only.
5. Review logs from the February–April 2026 period for signs of compromise: unusual login attempts, new accounts, configuration changes, uploaded shell files.
6. If a server is running an unsupported (end-of-life) version, it carries the same risk but will not receive an official patch — the only solution is migration to a supported version.

 

Newer Issues (August 2026)

It’s worth noting that the cPanel security story doesn’t end with CVE-2026-41940. On August 27, 2026, a new critical vulnerability was published — CVE-2026-65643, related to the parked and add-on domain functionality, which allows an already-authenticated user to create arbitrary files and potentially achieve code execution with root privileges. A separate advisory was also published affecting installations running Phusion Passenger.

Bottom line: cPanel/WHM server administrators should maintain an ongoing practice of monitoring vendor security advisories, rather than reacting only once to a single incident.