CVE-2026-41940

What it actually does

This is a critical unauthenticated remote authentication bypass in the cPanel, WHM, and WP Squared login flow. A network-reachable attacker can gain access to the control panel without valid credentials, enabling administrative actions normally protected by authentication. Depending on the exposed interface and privileges reached, this can lead to account takeover, website modification, file access, database access through hosted applications, creation of persistent users or API tokens, service disruption, and full compromise of hosted control-plane functions.

Why it matters to the business

Successful exploitation can give attackers control over hosting administration, which may allow website defacement, data theft, email abuse, malware deployment, customer account compromise, and ransomware activity. Because this issue is in CISA KEV, has very high EPSS, is reported as actively exploited in the wild, and is associated with ransomware activity, exposed systems should be treated as urgent remediation priorities. Organizations running internet-facing cPanel or WHM should assume elevated risk until patched and reviewed for compromise.

How an attack unfolds

An attacker scans the internet for exposed cPanel, WHM, or WP Squared management interfaces, commonly on cPanel and WHM service ports. After identifying a vulnerable version, the attacker targets the login workflow and abuses the missing authentication control to obtain an authenticated control-panel session or reach privileged functions without valid credentials. Once inside, the attacker can enumerate hosted accounts, alter domains and DNS settings, access file managers, create new users or API tokens, modify web content, upload web shells or malware, change email settings, and establish persistence. In ransomware-motivated activity, access to the hosting control plane may be used to stage payloads, destroy or encrypt hosted content, disrupt services, and pressure victims through operational outage and data exposure.

How to fix it

Immediately update cPanel, WHM, and WP Squared installations to the latest vendor-supported patched release; no exact fixed version was provided in the supplied data, so administrators should follow the current vendor security advisory and update channel guidance. Run the vendor update process, verify the resulting version, and restart relevant cPanel services. If immediate patching is not possible, restrict access to cPanel and WHM interfaces to trusted administrative networks through firewall rules, VPN, or allowlisting; remove direct internet exposure where feasible. Disable or tightly restrict unused management services. Treat multi-factor authentication as defense-in-depth only, because an authentication bypass may circumvent the login flow. After patching, invalidate active sessions, rotate administrative passwords and API tokens, review account-level credentials, remove unauthorized users or keys, and verify backups before restoring any affected content.

How to confirm the fix worked

Confirm the installed cPanel, WHM, or WP Squared version is on a vendor-fixed release using product-native version checks such as the WHM interface, update logs, package metadata, or command-line version output. Verify that automatic update jobs completed successfully and that cPanel services restarted cleanly. Confirm that ports commonly used for cPanel and WHM are not exposed to untrusted networks unless explicitly required. Review firewall, VPN, and allowlist controls for management interfaces. Perform an authenticated administrative review for unexpected users, API tokens, SSH keys, reseller privileges, domain changes, DNS changes, cron jobs, file-manager uploads, and recently modified web roots. Do not validate by running public exploit code against production systems; use vendor-provided checks or controlled security testing in an authorized environment.

Typical attack path

1. Scan for internet-exposed cPanel, WHM, or WP Squared interfaces.
2. Fingerprint the service version or behavior to identify likely vulnerable deployments.
3. Send crafted requests to the login flow to bypass authentication.
4. Establish an unauthorized control-panel or administrative session.
5. Enumerate hosted accounts, domains, files, email settings, users, and API tokens.
6. Create persistence through new users, API tokens, SSH keys, cron jobs, web shells, or configuration changes.
7. Modify, steal, encrypt, or destroy hosted data and web content.
8. Use the compromised server for follow-on activity such as phishing, malware hosting, spam, credential theft, or ransomware extortion.

How to detect it

Investigate whether exposed systems received suspicious requests to cPanel, WHM, or WP Squared login endpoints followed by successful administrative activity without a corresponding legitimate authentication event. Review cPanel and WHM access, login, error, update, and administrative audit logs, especially around the first known exposure window and the 103 days since publication. Focus on access to management ports, successful sessions from unfamiliar IP addresses or geographies, session creation without normal username/password validation, abnormal user-agent strings, high-volume probing, and administrative changes shortly after unauthenticated login-flow requests. Examine hosted accounts for new or modified users, API tokens, SSH keys, cron jobs, mail forwarders, DNS records, file-manager uploads, web shells, and recently modified PHP, Perl, shell, or archive files in web-accessible paths. For ransomware-related activity, look for rapid file modification or deletion patterns, encryption-like filename changes, ransom notes, disabled services, backup tampering, and unexpected privilege escalation or lateral movement from the hosting server. Correlate web/control-panel logs with system authentication logs, shell history, process execution, package installation logs, and network connections to determine whether control-panel access led to operating-system-level compromise.

• /usr/local/cpanel/logs/access_log
• /usr/local/cpanel/logs/login_log
• /usr/local/cpanel/logs/error_log
• /usr/local/cpanel/logs/session_log
• /usr/local/cpanel/logs/api_tokens_log
• /usr/local/cpanel/logs/cphulkd.log
• /usr/local/cpanel/logs/update_analysis.log
• /usr/local/cpanel/logs/license_log
• /var/log/secure
• /var/log/messages
• /var/cpanel/users/
• /var/cpanel/resellers
• /var/cpanel/authn/
• /var/cpanel/sessions/
• /usr/local/cpanel/3rdparty/bin/perl
• /usr/local/cpanel/cpsrvd
• cpsrvd
• whostmgrd
• cpaneld
• cphulkd
• tcp/2082
• tcp/2083
• tcp/2086
• tcp/2087
• tcp/2095
• tcp/2096
• /frontend/
• /cpsess
• /login/
• login_only=1
• WHM
• cPanel
• Sorry Ransomware

What your security team should do

• Patch or otherwise remove internet exposure immediately; this vulnerability is in CISA KEV, has active exploitation, and is associated with ransomware activity.
• Prioritize all internet-facing cPanel, WHM, and WP Squared systems for emergency inventory, upgrade, and exposure reduction before the CISA due date of 2026-05-03 where applicable.
• Assume vulnerable externally reachable systems may have been accessed and perform compromise assessment, not just version remediation.
• Restrict management interfaces to VPN or trusted administrative IP ranges and block public access to unnecessary cPanel and WHM ports.
• Invalidate sessions and rotate administrative credentials, API tokens, reseller credentials, and SSH keys after patching.
• Review for unauthorized control-panel users, API tokens, web shells, modified hosted files, DNS changes, mail forwarders, cron jobs, and privilege changes.
• Increase monitoring on cPanel and WHM logs for anomalous logins, session creation without normal authentication events, and administrative actions from unusual IP addresses.
• Ensure reliable offline or immutable backups exist before remediation activities and verify restore procedures in case ransomware or destructive activity is discovered.