Critical cPanel and WHM bug exploited as a zero-day, PoC now available

The critical CVE-2026-41940 authentication bypass vulnerability in cPanel, WHM, and WP Squared is being actively exploited in the wild and has been leveraged in attempts since late February. It is unclear when exploitation started, but KnownHost, a hosting provider that uses cPanel, said the day the vulnerability was disclosed that "successful exploits have been seen in the wild" before a fix became available. However, KnownHost CEO Daniel Pearson stated that the company has "seen execution attempts as early as 2/23/2026." Newly published technical details, which can be used to develop an exploit, reveal that the issue is a "Carriage Return Line Feed (CRLF) injection in the login and session loading processes of cPanel & WHM." cPanel released a fix on April 28, following pressure from hosting providers. To protect customers, Namecheap temporarily blocked connections to cPanel and WHM ports 2083 and 2087 until patches became available. A report from offensive security company watchTowr explains that the flaw is caused by improper session handling in cPanel & WHM, where user-controlled input from the Authorization header is written into server-side session files before authentication and without proper sanitization. watchTowr researchers also published a detailed analysis on how the bug can be triggered to log into the system without validating the provided password, which can be used to develop a working exploit. According to Rapid7, Shodan internet scans show that there are ...