# CVE-2026-41940: cPanel & WHM - Authentication Bypass

> Live exploitation tracking for CVE-2026-41940 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-41940

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** cPanel & WHM
- **Weaknesses:** CWE-93 (Improper Neutralization of CRLF Sequences ('CRLF Injection')); CWE-306 (Missing Authentication for Critical Function)
- **Tags:** management_panel

## Description

cPanel and WHM contain an authentication bypass vulnerability in the login flow caused by CRLF injection in session file handling. The cpsrvd daemon writes session files to disk before authentication occurs, and an attacker can manipulate the whostmgrsession cookie and inject crafted lines via a malicious Basic Authorization header. The system writes the session file without sanitizing the data, allowing the attacker to insert arbitrary session properties such as user=root, achieving full administrative access without credentials.

## CrowdSec analysis

[CVE-2026-41940](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-41940) is a critical authentication bypass vulnerability in cPanel & WHM affecting all supported versions prior to the April 28, 2026 patch. The flaw stems from a CRLF injection in the session file handling of the cpsrvd daemon, allowing unauthenticated remote attackers to inject arbitrary session properties — including root-level privileges and 2FA bypass flags — into pre-authentication session files. Successful exploitation grants full administrative control over WHM, enabling attackers to manage all hosted websites, databases, email accounts, SSL certificates, and server configurations without any credentials.

CrowdSec has been tracking this vulnerability and its exploits since 30th of April 2026.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2026-41940 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting.
CrowdSec data also reveals a clear uptick in attacks involving CVE-2026-41940 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Attackers exploit the `/login/?login_only=1` endpoint by sending a failed login POST to obtain a pre-authentication session cookie, then submit a follow-up request with a crafted `Authorization: Basic` header containing CRLF-injected session directives (user=root, hasroot=1, tfa_verified=1) to promote the session to fully authenticated root access on WHM port 2087.

## Timeline

- 2026-04-29: CVE Published. CVE-2026-41940 is published to NVD.
- 2026-04-30: Rule Released. CrowdSec releases a rule to detect CVE-2026-41940 exploitation attempts against the CrowdSec Network.
- 2026-04-30: CISA KEV. CVE-2026-41940 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2026-05-03: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2026-05-04: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2026-41940 for the first time.

## References

- https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026
- https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/
- https://github.com/watchtowrlabs/watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py
- https://hadrian.io/blog/cve-2026-41940-a-critical-authentication-bypass-in-cpanel
- https://nvd.nist.gov/vuln/detail/CVE-2026-41940
- https://www.rapid7.com/blog/post/etr-cve-2026-41940-cpanel-whm-authentication-bypass/
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-41940.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-41940) follows observed exploitation activity for CVE-2026-41940. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.