Critical Vulnerability in cPanel and WHM: What You Need to Know

In early 2026, researchers disclosed one of the most severe vulnerabilities in cPanel & WHM’s history. The hosting management platform powers tens of millions of websites worldwide. The flaw allowed attackers to gain full root access to servers without any valid login credentials.

What is CVE-2026-41940

The vulnerability, tracked as CVE-2026-41940, received the maximum CVSS score — 9.8 out of 10.0. It affects cpsrvd, the daemon that serves the cPanel, WHM, and Webmail interfaces on ports 2082/2083/2086/2087/2095/2096.

Technically, the issue is a combination of two weaknesses:

• This is a CRLF injection in how the login process handles the Basic Authorization header. It lets attackers inject arbitrary lines into the server’s session file.
• A race condition also exists between the session’s temporary text file and its JSON cache. Attackers could insert a value such as user=root before the system validated and sanitized the data..

The result: an attacker obtains a session with administrator (root) privileges without ever going through a genuine authentication process.

 

 

 

 

 

 

Scope of the Problem

• The vulnerability affects all supported versions of cPanel & WHM after 11.40, as well as the WP Squared module.
• According to Shodan telemetry cited by Rapid7, the number of exposed, publicly reachable instances is close to 1.5 million.
• Investigation shows attackers had actively exploited the vulnerability as a zero-day since late February 2026 — nearly two months before the official disclosure on April 28, 2026.
• Hosting providers such as Namecheap, hosting.com, KnownHost, HostPapa, and InMotion Hosting responded rapidly, temporarily blocking network-level access to cPanel/WHM ports until the patch could be applied.
  
  

What a Successful Attack Enables

Upon successful exploitation, an attacker gains full administrative control, which means they can:

• read and modify all hosted accounts and databases;
• create backdoor accounts for persistent access;
• install malware or ransomware;
• redirect traffic or intercept email communications;
• pivot laterally into other systems on the client’s network.

Patch and Recommended Actions

cPanel released an emergency patch just hours after researchers disclosed the issue:

1. Update immediately to cPanel & WHM 11.136.0.5 or later, and WP Squared 136.1.7 or later.
2. Restart cpsrvd after updating (/scripts/restartsrv_cpsrvd) — the update alone is not sufficient if you don’t reload the service.
3. Confirm your server has automatic updates turned on — servers with auto-update disabled or a pinned version will not patch themselves.
4. Restrict access to administrative ports (2083, 2087) via firewall to trusted IP addresses only.
5. Review logs from the February–April 2026 period for signs of compromise: unusual login attempts, new accounts, configuration changes, uploaded shell files.
6. If a server is running an unsupported (end-of-life) version, it carries the same risk. However, it will not receive an official patch — the only solution is migration to a supported version.

 

Newer Issues (August 2026)

It’s worth noting that the cPanel security story doesn’t end with CVE-2026-41940. On August 27, 2026, researchers published a new critical vulnerability — CVE-2026-65643, related to the parked and add-on domain functionality, which allows an already-authenticated user to create arbitrary files and potentially achieve code execution with root privileges. The vendor also published a separate advisory affecting installations running Phusion Passenger.

Bottom line: cPanel/WHM server administrators should maintain an ongoing practice of monitoring vendor security advisories, rather than reacting only once to a single incident.