CTI · corroborated · 2026-09-21

cPanel/WHM Critical Authentication Bypass CVE-2026-41940

Full story & timeline

MITRE ATT&CK

• T1190 Exploit Public-Facing Application Initial Access
• T1078 Valid Accounts Stealth
• T1110 Brute Force Credential Access

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: cPanel WHM Authentication Bypass CVE-2026-41940 Exploitation
id: 8b3e2f4a-9c5d-4e6b-af7c-2d3e4f5a6b7c
status: experimental
description: Detects exploitation of CVE-2026-41940, a CRLF injection in cPanel WHM session management allowing unauthenticated root access. Public PoC available, confirmed exploited in the wild feeding Mirai-like botnet activity since April 2026.
references:
  - https://bleepingcomputer.com
  - https://rapid7.com
  - https://securityweek.com
author: Tia N. List
date: 2026-09-21
tags:
  - attack.initial_access
  - attack.stealth
  - attack.credential_access
  - CVE.2026.41940
logsource:
  category: network_connection
  product: linux
detection:
  selection_cpanel_ports:
    dst_port:
      - 2083
      - 2087
      - 2086
      - 2096
  selection_brute_tcp23:
    dst_port: 23
    src_port:
      - 2083
      - 2087
  condition: selection_cpanel_ports or selection_brute_tcp23
falsepositives:
  - Legitimate cPanel administration connections
level: critical

References

• https://bleepingcomputer.com
• https://rapid7.com
• https://securityweek.com