We are writing to inform you of a critical security vulnerability, CVE-2026-41940, affecting cPanel & WHM — the web hosting control panel software used to manage websites and servers. This vulnerability has a CVSS score of 9.8 (Critical) and is being actively exploited in the wild. We strongly urge you to take action immediately.


━━ WHAT IS THE VULNERABILITY? ━━

CVE-2026-41940 is an authentication bypass vulnerability caused by a CRLF (Carriage Return Line Feed) injection flaw in the cPanel login and session-handling process. It allows unauthenticated remote attackers to bypass the login process entirely and gain full administrative access to the cPanel or WHM control panel — without any username or password.

Successful exploitation could give an attacker complete control over:
• Your cPanel host system and its configuration
• All databases hosted on the server
• All websites and accounts managed under the panel

The vulnerability affects all cPanel & WHM versions after v11.40, as well as v136.1.7 of WP Squared (a managed WordPress hosting platform built on cPanel).


━━ IS THIS BEING ACTIVELY EXPLOITED? ━━

Yes. Active exploitation has been observed in the wild since at least 23 February 2026 — several weeks before the public disclosure. A proof-of-concept exploit was published by security firm watchTowr on 29 April 2026, which means exploitation attempts are now expected to increase significantly. Security researchers have observed nearly 4,000 attack attempts targeting exposed cPanel instances, spanning multiple industries and countries.


━━ WHAT SHOULD YOU DO? ━━

1. Update immediately
Apply the security patch released by cPanel/WebPros on 28 April 2026. Verify your cPanel build version after updating and restart the cPanel service (cpsrvd).

2. Block access at the firewall (if you cannot patch immediately)
Block inbound traffic on the following ports:
*2083 (cPanel HTTPS)
*2087 (WHM HTTPS)
*2095 (Webmail HTTP)
*2096 (Webmail HTTPS)

3. Check for signs of compromise
cPanel has released a detection script to help identify known indicators of compromise. We recommend running this against any affected systems. Additionally:
* Review WHM access logs for any unauthorised activity
*Inspect session files for anomalies
*Purge existing sessions and force password resets for root and WHM users
*Check for any persistence mechanisms (new admin accounts, changed configurations, etc.)

4. Contact your hosting provider
If your cPanel environment is managed by a hosting provider, contact them to confirm that the patch has been applied to your server.


━━ FURTHER RESOURCES ━━

• cPanel Security Advisory: https://support.cpanel.net
• Rapid7 Technical Analysis: https://www.rapid7.com/blog/post/etr-cve-2026-41940-cpanel-whm-authentication-bypass/
• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-41940

If you have any questions or need assistance applying this patch, please do not hesitate to contact our support team.

We take the security of your infrastructure seriously and will continue to monitor this situation and provide updates as new information becomes available.

https://t.me/zaihuapd/41138
这个和上次的 CVE-2026-31431 名为"Copy Fail" 的还不同，这次是CVE-2026-41940，主要是cpanel和whm，很多商家都用这两个