cPanel zero-day exploited since February, 1.5 million instances exposed

CVE-2026-41940 is a CVSS 9.8 authentication bypass in cPanel and WHM. Attackers have been exploiting it in the wild since at least February 23. The fix only shipped on April 28.

That gap is the story. Exploitation attempts were happening more than two months before a patch existed.

The vulnerability is a CRLF injection in cPanel’s login and session loading processes. User-controlled input from the Authorization header gets written into server-side session files before authentication and without sanitization. The result: an unauthenticated attacker can log into any cPanel or WHM instance without a password. Including as root via WHM.

watchTowr published a detailed technical analysis showing exactly how the bug triggers. The root cause is embarrassingly simple. The Authorization header value gets injected into a session file, and a crafted payload with carriage return and line feed characters breaks out of the intended session data structure to forge a valid authenticated session.

KnownHost CEO Daniel Pearson confirmed that his company saw execution attempts as early as February 23. Namecheap took the extraordinary step of blocking all connections to cPanel and WHM ports 2083 and 2087 until patches became available. InMotion Hosting did the same. Web Hosting Canada blocked access across all managed servers. When hosting providers start firewalling off their own control panels, you know the situation is bad.

Rapid7 reports approximately 1.5 million cPanel instances exposed on the internet according to Shodan scans. There is no data on how many of those are actually vulnerable. The flaw affects all cPanel versions after 11.40, which covers basically every deployment currently running.

The vendor also disclosed that WP Squared, a WordPress management panel built on cPanel, is affected too. The original advisory understated the scope.

Cloudflare pushed an emergency WAF release on April 30 specifically to block exploitation of CVE-2026-41940. That is not a normal thing for Cloudflare to do. Emergency WAF releases happen when something is burning.

cPanel released fixes for seven version branches: 11.110, 11.118, 11.126, 11.132, 11.134, 11.136, and WP Squared 11.136.1. The vendor strongly recommends restarting the cpsrvd service after patching, which is easy to miss if you are just running the updater and moving on.

For anyone who cannot patch immediately, the mitigation is blunt: block external access to ports 2083, 2087, 2095, and 2096. Or stop cpsrvd and cpdavd entirely. Neither option is great for a hosting provider that needs its control panel accessible.

cPanel also released a detection script to check for indicators of compromise. If you find them, the recommended response is to purge all sessions, reset every credential, audit logs, and investigate persistence mechanisms. That is a full incident response, not a quick cleanup.

watchTowr published a Detection Artifact Generator script as well, which lets operators verify whether their instances are vulnerable without waiting for the vendor’s detection tool.

This incident exposes a structural problem in the hosting industry. cPanel runs the control panels for an estimated 70 million domains. When a single point of failure this large has a pre-auth authentication bypass, the blast radius is absurd. And the fact that attackers were quietly exploiting it for months before anyone outside the vendor knew says something uncomfortable about the disclosure timeline.

Sources: BleepingComputer, The Register, watchTowr, Rapid7, Cloudflare