CVE-2026-41940

Name of the Vulnerable Software and Affected Versions cPanel and WHM versions prior to 11.110.0.97 cPanel and WHM versions prior to 11.118.0.63 cPanel and WHM versions prior to 11.126.0.54 cPanel and WHM versions prior to 11.132.0.29 cPanel and WHM versions prior to 11.134.0.20 cPanel and WHM versions prior to 11.136.0.5 WP Squared versions prior to 136.1.7

Description An authentication bypass exists in the login flow of the cpsrvd service daemon, affecting cPanel, WHM, and WP Squared. The issue stems from improper sanitization of the Authorization header, allowing a CRLF (Carriage Return Line Feed) injection. By sending a specially crafted Basic Authorization header containing r characters, an unauthenticated remote attacker can manipulate the temporary session files created on disk. This allows the attacker to inject arbitrary properties, such as user=root, into the session file. When the system reloads the session, it accepts these injected values as valid, granting the attacker full administrative root access without a password. Approximately 1.5 to 2 million instances are estimated to be exposed worldwide. This flaw has been exploited in the wild by the Sorry ransomware group and Mirai variants to gain root access, encrypt files, and establish persistence via stealth backdoors.

Recommendations Update cPanel and WHM to versions 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, or 11.136.0.5. Update WP Squared to version 136.1.7 or later. As a temporary mitigation, block inbound traffic on ports 2082, 2083, 2086, 2087, 2095, and 2096. Restrict access to the WHM management plane to trusted static IP addresses or VPN ranges. Audit /var/cpanel/sessions/ for files containing unauthorized user=root or user=admin entries. Perform a rotation of root, WHM, reseller, and user passwords if a breach is suspected.