Tia N.List

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-41940 9.8
WebPros · cPanel & WHM and WP2 (WordPress Squared) · Added 2026-04-30 · Published 2026-04-29
3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityWebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability
VendorWebPros
ProductcPanel & WHM and WP2 (WordPress Squared)
Date added2026-04-30
Due date2026-05-03
CISA catalogView on CISA KEV catalog
Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWECWE-306
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Descriptions

KEV: WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

NVD: cPanel and WHM versions prior to 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, and 11.136.0.5 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

Compliance SSVC + BOD 26-04

Automatableyes
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline3 days + forensic
Forensic (public)Required
Forensic (non-public)Required

Research metadata

Last researched2026-08-26 14:44 UTC
Searches5
Component defaultyes
Sources https://nvd.nist.gov/vuln/detail/CVE-2026-41940
https://support.cpanel.net/hc/en-us/articles/40073787579671-Security-CVE-2026-41940-cPanel-WHM-WP2-Security-Update-04-28-2026
https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/
https://www.rapid7.com/blog/post/etr-cve-2026-41940-cpanel-whm-authentication-bypass/
https://github.com/watchtowrlabs/watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py
https://github.com/yurahshell/CVE-2026-41940
https://github.com/olofsatte/CVE-2026-41940-PoC
https://github.com/anach-ai/CVE-2026-41940
https://github.com/assetnote/cpanel2shell-scanner
https://cybersecuritynews.com/cpanel-0-day-authentication-bypass-vulnerability/
https://www.picussecurity.com/resource/blog/cve-2026-41940-explained-cpanel-whm-authentication-bypass-hit-1-5m-servers
https://docs.cpanel.net/release-notes/release-notes
https://docs.wpsquared.com/changelogs/versions/changelog/#13617

Hunting hypothesis agent

Hunt WAF logs for Authorization: Basic headers with base64-encoded CRLF injection (hasroot=1, user=root) followed by /scripts2/listaccts returning 401 — CVE-2026-41940 cPanel WHM auth bypass injects root session attributes via CRLF.

Research details

Componentcpsrvd (cPanel service daemon) - session loading/saving (CRLF injection in Basic auth handler)
PreconditionsTarget must run cPanel & WHM after version 11.40 (or WP Squared below 136.1.7) with cpsrvd accessible on ports 2083/2087/2095/2096. No authentication or user interaction required; the attacker only needs network reachability to the cPanel/WHM web interface. The vulnerability is pre-authentication and remotely exploitable over the network. agent
DeliveryHTTP request with a crafted Authorization: Basic header containing CRLF-injected payload (\r\n characters) combined with a whostmgrsession cookie that omits the encryption-key segment (no comma-and-hex tail). The CRLF injection writes arbitrary session attributes (e.g., hasroot=1, user=root, tfa_verified=1, successful_internal_auth_with_timestamp) into the raw session file. A follow-up request that triggers do_token_denied (missing cp_security_token) promotes the injected lines from the raw file into the JSON cache, which loadSession trusts on subsequent requests, granting unauthenticated root-level WHM access.
Public PoCyes
PoC URLs https://github.com/watchtowrlabs/watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py
https://github.com/yurahshell/CVE-2026-41940
https://github.com/olofsatte/CVE-2026-41940-PoC
https://github.com/anach-ai/CVE-2026-41940
https://github.com/assetnote/cpanel2shell-scanner Third-party repos; verify before use.
Advisoryhttps://support.cpanel.net/hc/en-us/articles/40073787579671-Security-CVE-2026-41940-cPanel-WHM-WP2-Security-Update-04-28-2026
Exploit notesCVSS attack complexity: LOW | CRITICAL severity (CVSS >= 9.0). Exploitation chains three primitives: (1) CRLF injection via Basic auth header with no-ob cookie to bypass pass-field encryption, (2) writing arbitrary key=value lines into the raw session file, (3) triggering do_token_denied to promote the injection into the JSON session cache. watchTowr published full technical analysis and working PoC on April 29, 2026. In-the-wild zero-day exploitation observed since ~February 23, 2026 (per KnownHost). ~1.5 million internet-exposed instances per Shodan.
SummaryWebPros cPanel & WHM and WP2 (WordPress Squared) | cpsrvd session loading/saving CRLF injection authentication bypass (CWE-306) | Multiple public PoCs available (watchTowr, yurahshell, olofsatte, anach-ai, assetnote) | Vendor advisory published | Active in-the-wild exploitation since Feb 2026 | ~1.5M exposed instances | Patched in cPanel 11.110.0.97+ / WP Squared 136.1.7+

Tia coverage

First reported2026-04-29
First exploit report2026-04-30
Exploit report → KEV0 days before the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

cpanel-whm-critical-authentication-bypass-cve-2026-41940-cvss-9cpanelsniper-poc-released-as-shadowserver-confirms-44-000-compro

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.

Source on GitHub