What Happened
On April 28, 2026, cPanel pushed an emergency patch for CVE-2026-41940 — a critical authentication bypass vulnerability in cPanel & WHM and WP Squared carrying a CVSS score of 9.8. The flaw had been exploited as a zero-day since at least February 23, 2026, meaning attackers had roughly two months of unrestricted access to hosting servers before a fix was available. Rapid7 confirmed active exploitation in the wild, and CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog within days of disclosure.
SecurityWeek reported that the bug was "exploited as a zero-day for months" — a rare admission that underscores how long attackers operated undetected. SecurityWeek noted that a public proof-of-concept was already circulating by the time the patch dropped, dramatically widening the attack surface.
Technical Analysis
CVE-2026-41940 is a pre-authentication remote authentication bypass. According to Picus Security's technical analysis, the exploit chains three distinct weaknesses: a CRLF injection in cPanel's session writer, an encryption-skip triggered by a malformed cookie, and a quirk in how cPanel caches sessions that allows an attacker to "promote" the injected payload into a privileged login session. No valid credentials are required at any point in the chain.
The vulnerability affects all cPanel & WHM versions after 11.40, including WP Squared. Patched versions range from 11.110 through 11.136, depending on the specific product line. The attack vector is network-based with low complexity — meaning any attacker who can reach the cPanel management port (2083/2087) can attempt exploitation without prior authentication.
Who's Affected
cPanel & WHM powers an estimated 1.5 million servers worldwide, making this one of the most consequential hosting infrastructure vulnerabilities of 2026. Picus Security estimates that the majority of these servers were running vulnerable versions at the time of disclosure. The two-month exploitation window means that any server running an unpatched version during February–April 2026 should be considered potentially compromised.
The downstream impact extends far beyond the hosting providers themselves. Each compromised cPanel server can host hundreds or thousands of customer websites, email accounts, and databases. A single successful authentication bypass gives the attacker root-level administrative control — the ability to create accounts, modify DNS records, access email, and deploy malware across every site on the server.
How to Protect Yourself
If you run cPanel & WHM or WP Squared, take these steps immediately:
- Patch now. Update to the latest patched version (11.110+ for cPanel & WHM, 136.1.7+ for WP Squared). If you haven't updated since before April 28, assume your server may have been accessed.
- Audit access logs. Review /usr/local/cpanel/logs/access_log and /var/log/messages for suspicious activity dating back to February 2026. Look for unexpected session creations or account modifications.
- Rotate all credentials. Change root passwords, API tokens, and service account keys. Any credential stored on the server may have been exposed.
- Check for unauthorized accounts. Run
whmapi1 listacctsand verify every account. Attackers frequently create backdoor accounts with elevated privileges. - Enable two-factor authentication. If not already enforced, require 2FA for all cPanel and WHM accounts immediately. This limits the impact of any future authentication bypass.
- Restrict management port access. Limit inbound connections to ports 2083 and 2087 to known IP ranges using your firewall. This reduces the attack surface for network-based exploits.
The Sable Angle
Supply chain and infrastructure-level vulnerabilities like CVE-2026-41940 are exactly the kind of threat that traditional vulnerability scanners miss — especially when the exploit chain involves session manipulation rather than a simple buffer overflow. At Sable, our offensive security team routinely tests hosting control panels, cloud management interfaces, and multi-tenant infrastructure for authentication bypass paths that automated tools can't find.
If you're a hosting provider or manage cPanel infrastructure at scale, our research on startup infrastructure vulnerabilities covers the attack patterns we see most often in shared hosting environments. The bottom line: patching is necessary but not sufficient. You need adversarial testing that simulates how actual attackers chain low-severity flaws into full server takeovers.