CVE-2026-41940: WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability
WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
Overview
cPanel and WHM contain an authentication bypass in the session management layer, specifically in the code responsible for loading and saving session data. An unauthenticated remote attacker can manipulate session file entries by injecting special characters into session-related fields, bypassing the login gate entirely without supplying valid credentials. All cPanel and WHM versions from 11.40 through multiple release branches are affected, as is WP Squared (WordPress Squared) before version 136.1.7. This vulnerability has been actively exploited in the wild, including in ransomware attacks.
Vulnerability details
The flaw resides in cPanel's session management modules, specifically Cpanel/Session.pm and Cpanel/Session/Load.pm. The saveSession function failed to sanitize special characters such as carriage returns, newlines, equals signs, and commas from session data fields before writing them to session files. Because session files use these characters as field delimiters, an attacker who can inject them into session-related input can manipulate the structure of a session file, inserting or overwriting entries that the authentication logic subsequently reads as valid. This is a classic instance of CWE-306: a critical function, the control panel login flow, can be exercised without authentication because the enforcement mechanism is undermined by the unsanitized data it consumes.
An attacker sends a crafted HTTP request to the cPanel or WHM login or session endpoint, embedding injected special characters in session-related fields. The server writes the manipulated data into a session file, which is then loaded and interpreted as an authenticated session. No credentials are required. Successful exploitation grants full access to the control panel: WHM provides root-level server administration including SSL management and account control, while cPanel provides per-account hosting management. A public proof-of-concept is titled 'AuthBypass-to-RCE', indicating remote code execution is achievable following the bypass. This vulnerability was confirmed exploited as a zero-day and has been used in ransomware attacks.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Review cPanel and WHM access logs for authenticated session activity that has no corresponding successful login event, particularly requests to administrative interfaces arriving without a preceding credential submission in the session timeline.
- Run the vendor-supplied detection script referenced in the cPanel security advisory (updated multiple times between April 28 and May 4, 2026) to identify session files containing injected special characters or anomalous field structures indicative of manipulation.
Remediation
Additional hardening
- Upgrade cPanel and WHM to a patched build for your release branch: 11.86.0.41, 11.94.0.28, 11.102.0.39, 11.110.0.97, 11.118.0.63, 11.124.0.35, 11.126.0.54, or 11.130.0.19 and above; upgrade WP Squared to 136.1.7 or above. See References for the full vendor advisory.
- Restrict network access to the cPanel (port 2082/2083) and WHM (port 2086/2087) management interfaces using firewall rules or host-based controls, allowing only known administrative IP addresses to reach these ports.
- Place a WAF in front of the cPanel and WHM login endpoints to block requests containing raw carriage return, newline, or equals-sign sequences in session-related parameters if patching is delayed.
- Audit all cPanel and WHM accounts for unauthorized changes during the exposure window, including new accounts, SSH keys added, cron jobs modified, or files written, as exploitation has been confirmed in active ransomware campaigns.
Key dates
References
- https://docs.wpsquared.com/changelogs/versions/changelog/#13617
- https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026
- https://docs.cpanel.net/release-notes/release-notes/
- https://nvd.nist.gov/vuln/detail/CVE-2026-41940"
- https://www.vulncheck.com/advisories/cpanel-and-whm-authentication-bypass-via-login-flow
- https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/
- https://github.com/watchtowrlabs/watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py
- https://docs.cpanel.net/release-notes/release-notes
Frequently asked questions
Does CVE-2026-41940 affect my FedRAMP authorization?
If WebPros cPanel & WHM and WP2 (WordPress Squared) runs inside your authorization boundary, yes. CVE-2026-41940 is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and its May 3, 2026 remediation deadline has already passed. For a FedRAMP-authorized service, an unpatched KEV inside the boundary is an assessor finding. An overdue one is a finding your assessor and sponsoring agency can see right now. Your path forward is to remediate immediately or formally document the mitigation and the delay.
How does Knox help me handle CVE-2026-41940?
Knox does not patch your software. Remediating WebPros cPanel & WHM and WP2 (WordPress Squared) is your responsibility under the FedRAMP shared-responsibility model. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, plus Knox's automated continuous monitoring platform and audit-artifact coverage that document the fix for your next assessment. Applying the patch is yours to own; maintaining a defensible compliance posture while you do it is not something you have to manage alone.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues on a continuous basis. When something like CVE-2026-41940 surfaces, exposure appears during ongoing monitoring rather than waiting to be flagged at an assessor's scheduled review. That gap between disclosure and discovery closes significantly.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2026-41940's remediation deadline of May 3, 2026 has passed. What happens now?
If CVE-2026-41940 remains unremediated, it sits on your Plan of Action and Milestones (POA&M) right now. A growing POA&M list is what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Closing the finding out and documenting why the deadline was missed is what keeps your authorization intact and the agency relationship on solid footing.
Ready to achieve FedRAMP authorization in 90 days or less?
Schedule a meeting to discuss scope, parse readiness, and map your company’s accelerated path to FedRAMP authorization.
_Horizontal_RGB.png)
