Critical cPanel Authentication Vulnerability Identified — Update Your Server Immediately
Summary: cPanel and WHM contain an authentication bypass, tracked as CVE-2026-41940 with a CVSS score of 9.8, caused by a CRLF injection in the login and session loading processes that lets unauthenticated remote attackers write arbitrary properties such as user=root into their session file and gain administrative access. Namecheap blocked TCP ports 2083 and 2087 as a precaution, KnownHost CEO Daniel Pearson said the flaw has been exploited in the wild for at least 30 days, and CISA added it to the KEV catalog with a May 3, 2026 patch deadline for FCEB agencies.
Why it matters: WHM grants root administrative access to the server, so an attacker who lands there can read every customer hosting account, create backdoor accounts, and pivot into customer networks, and Eye Security counted over 2 million cPanel instances connected to the internet.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-41940
- Related
- CVE-2026-41940: Web Pros cPanel & WHM and WP2 (Word Press Squared) Missing Authentication for Critical Function Vulnerability Known Exploited Vulnerabilities · Apr 30, 2026