cPanel Authentication Bypass Vulnerability (CVE‑2026‑41940): Patch & Mitigation Guide

A CVE‑2026‑41940 security advisory released just days ago alert to a critical severity exploit in cPanel and WHM that could allow for authenticated access to vulnerable installs. This vulnerability is CVSS 9.8 Critical, meaning it’s a big deal for anyone running cPanel/WHM in production.

The security hole does not stop here, however. Any server that was using cPanel & WHM versions over 11.40 is vulnerable unless patched to the versions released in late April 2026 that we have announced. Hosting providers, VPS hosting owners, and sysadmins must check their versions immediately and patch version as sopatch their servers as soon as possible.

What Is CVE‑2026‑41940?

The authentication bypass vulnerability in cPanel, WHM, and WP Squared is CVE‑2026‑41940 that is due to improper session handling. Affected CRLF Injections in cPanel’s Session load & save to Create Spoofed Cookies

This could allow for an unauthenticated remote attacker to send specially crafted requests, injecting arbitrary properties into the session file (i.e. user=root). Credentials are not needed. When the session reloads, the attacker gets WHM access as administrator that can give him control of the server as well.

The lack of control over cPanel and WHM is what makes them particularly high value targets because cPanel is responsible for not just hosting accounts, DNS, databases but email as well; they provide root control. A failed level of authentication where an attacker passes may have access not only to accounts on a cPanel server but essentially the whole server.

Affected cPanel & WHM Versions

This vulnerability impacts versions of cPanel hosting & WHM since 11.40, and some variants of WP Squared.

Product	Affected Versions	Fixed Versions (minimum)
cPanel & WHM	All versions after 11.40	11.86.0.41, 11.110.0.97, 11.118.0.63, 11.124.0.35, 11.126.0.54, 11.130.0.19, 11.132.0.29, 11.134.0.20, 11.136.0.5
WP Squared	All versions prior to 11.136.1.7	11.136.1.7 and later

As you can see this applied to Shared hosting servers running cPanel/WHM. Secondly VPS and dedicated servers with cPanel installed and cloud instances (AWS, GCP, Azure, etc.) using cPanel/WHM. Always check which build you are running, until then marked as affected until you confirm otherwise.

What Could Happen If You Do Not Patch?

CVE‑2026‑41940 is more critical as it allows hackers to log in to WHM impersonating any user and without credentials if unpatched. Attackers leaking sensitive data would expose customer websites, databases, emails, and configuration files.

The exploit itself can be tested against any publicly accessible cPanel/WHM interface as it does not require authentication.

How to Check if Your Server Is Vulnerable

Follow these steps to see if your server is vulnerable or not:

Check version from WHM

• Log in to WHM (if you can still access it).
• Go to Home then Server Configuration then Server Information.
• Look for the cPanel & WHM version line.
• Compare your version with the fixed versions list.

If your version is higher than 11.40 and is not in the “Fixed Versions” list, your server is likely affected.

Check version from command line

SSH into your VPS server and run:

/usr/local/cpanel/cpanel -V

or you can check with this command in your Linux server:

cat /usr/local/cpanel/version

Again, compare the reported version with the patched versions. If your VPS is on a version post 11.40 and it’s not listed as fixed, then assume the server to be vulnerable till you update.

Steps to Fix CVE‑2026‑41940.

CVE-2026-41940 Can be patched through WHM or via command line.

1. Log in to WHM as root.
2. Go to Home > drop down to Update Tools > Upgrade to Latest Version.
3. The first thing to do is run the upgrade process and wait for the process.
4. After updating, check the server information for the new version.

If the upgrade tools do not present a patched version, refer to the command-line method below.

Execute the cPanel update command as the root user.

/usr/local/cpanel/scripts/upcp --force

Check the version after the update is done.

/usr/local/cpanel/cpanel -V

Ensure that the version corresponds to a specific build found in the “Affected cPanel & WHM Versions” section.

Now verify the WHM version again from the dashboard. Test normal WHM login behaviour. Check /var/log/cpanel/install.log (or similar) for any errors during the update. If your hosting control panel or hosting provider suggests it, restart the service.

systemctl restart cpanel

Temporary Mitigation (If You Cannot Patch Immediately)

If you can’t patch immediately, apply these temporary measures. They won’t fix the flaw but will limit exposure.

Use your firewall (e.g., csf, iptables, UFW) to allow WHM (port 2087) and cPanel (port 2083) access only from trusted IP addresses.

csf -a YOUR_TRUSTED_IP "Trusted Admin"

Block all inbound traffic to ports 2083, 2087, and 2095/2096 except from known management IPs.

Require admins to use a VPN when accessing WHM/cPanel. If possible, remove WHM from public exposure.

Use netstat -tlnp or ss -tlnp to confirm which ports are listening. Close or firewall any unnecessary services.

Monitor /var/log/cpanel/* and auth logs for unusual activity or login attempts.

These measures are temporary. You must patch as soon as possible.

Post‑Update Security Checks

After patching, perform these checks to validate your server is secure:

• After patching, run these checks to confirm your server is secure
• Check the patched version in WHM and from the command line.
• Review logs for suspicious logins or unusual activity around the patch time.
• Check for unknown WHM, root, or reseller accounts.
• Change root, WHM, and cPanel passwords; update SSH keys if needed.
• Ensure no unauthorized cron jobs or services have been added. Verify that only required ports and IP addresses are permitted.

Recommended Hardening for cPanel Servers

Enable two-factor authentication for all admin logins. Restrict WHM/cPanel access to specific IP addresses or networks. Set cPanel/WHM to update automatically or on a schedule. Keep off-site backups of configurations and data. It is that you make sure the same or similar issues do not occur in future. Implement logging, an intrusion detection system, or a managed security services.

FAQ