A critical authentication bypass vulnerability in cPanel & WHM, tracked as CVE-2026-41940, is being actively exploited in the wild, forcing emergency patch rollouts across the global web hosting industry.
Security researchers at watchTowr have released a proof-of-concept (PoC) detection tool that confirms the flaw enables unauthenticated attackers to gain root-level access to vulnerable hosting control panels, a scenario with catastrophic implications for shared hosting environments worldwide.
The flaw resides in the cpsrvd service of cPanel & WHM and affects all versions after 11.40, including installations that are no longer on a supported update track.
cPanel 0-Day Auth Bypass Exploited
According to cPanel’s security advisory published on April 28, 2026, the vulnerability is an authentication bypass that allows a remote, unauthenticated attacker to hijack privileged sessions without valid credentials.
The attack chain, as demonstrated by researcher Sina Kheirkhah (@SinSinology) of watchTowr, involves a multi-stage exploit sequence:
- Pre-auth session minting — The attacker initiates an unauthenticated session with the target’s WHM interface on port 2087.
- CRLF injection — A crafted HTTP request exploiting a CRLF injection flaw leaks a valid session token via a
HTTP 307redirect. - Cache poisoning gadget — The leaked raw token is propagated to the server-side cache via a
do_token_deniedrequest. - Root-level WHM access — The attacker authenticates as WHM root, confirmed by a successful
HTTP 200response from/json-api/version, returning full server version metadata.
The exploit targets ports 2083, 2087, 2095, and 2096, the standard cPanel and WHM access ports, making any internet-exposed control panel a viable target.
Reports indicate that the vulnerability was privately disclosed to cPanel approximately 2 weeks before public disclosure.
However, confirmed active exploitation in the wild forced cPanel to accelerate its emergency patch rollout on April 28, 2026.
Global hosting providers have reportedly taken control panels offline as a precautionary measure to prevent mass unauthorized access while applying patches.
The CVE identifier is currently listed as CVE-2026-Pending in the PoC tool, according to watchTowr, with the formal CVE-2026-41940 assignment tracking the official cPanel advisory.
Patched Versions
cPanel has released security patches for the following versions:
- 11.86.0.41, 11.110.0.97, 11.118.0.63, 11.126.0.54
- 11.130.0.19, 11.132.0.29, 11.134.0.20, 11.136.0.5
- WP Squared (WP²): 136.1.7
Administrators should treat this as an emergency priority and take immediate action:
- Update immediately using the cPanel update script:
/scripts/upcp --force - Verify the build version post-update:
/usr/local/cpanel/cpanel -V - Restart the cpsrvd service:
/scripts/restartsrv_cpsrvd - If auto-updates are disabled or the version is pinned, manually update these servers as a top priority, as they will not receive automatic patches.
For servers where immediate patching is not feasible, cPanel recommends one of two interim mitigations:
- Block inbound traffic on ports 2083, 2087, 2095, and 2096 at the firewall level.
- Turn off the cpsrvd and cpdavd services entirely using the WHM API until patching is complete.
With cPanel & WHM deployed across millions of shared, reseller, and dedicated hosting servers globally, the attack surface is enormous.
The authentication bypass to root-level WHM access essentially means an attacker could add, modify, or delete all hosted accounts, exfiltrate sensitive customer data, deploy web shells, or pivot further into hosting infrastructure.
The release of a public PoC dramatically lowers the bar for exploitation, placing unpatched servers at immediate risk from opportunistic threat actors and automated scanning campaigns.
Administrators running any cPanel version above 11.40 that has not yet received the patch should treat this as an active incident response scenario.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
