Executive Summary (BLUF)

A critical pre-authentication bypass vulnerability, tracked as CVE-2026-41940 (CVSS 3.1: 9.8), has been discovered in the login process of cPanel and WebHost Manager (WHM). This flaw allows remote, unauthenticated attackers to gain complete root-level administrative control over vulnerable hosting servers.

The vulnerability is currently under active, global mass-exploitation, with telemetry indicating over 44,000 IP addresses have already been compromised. Threat actors are leveraging this zero-day flaw to deploy the ‘Sorry’ ransomware and Mirai botnet variants, deliberately targeting government, military, and Managed Service Provider (MSP) networks. Due to the trivial nature of the exploit and the severity of the impact, immediate patching and network hardening are required to prevent systemic infrastructure compromise.

Current Landscape & Context

cPanel and WHM are ubiquitous in the web hosting industry, managing over 70 million domains globally. This massive footprint presents a highly lucrative attack surface for advanced persistent threats (APTs) and financially motivated cybercriminal syndicates.

Threat actors have been actively exploiting CVE-2026-41940 as a zero-day since February 2026. The primary motivation observed in current campaigns is extortion via the deployment of the ‘Sorry’ ransomware. However, the targeting of MSPs and government networks indicates a secondary objective: utilizing compromised WHM instances as supply-chain pivot points to access downstream customer networks, exfiltrate highly sensitive data, and systematically wipe backups to maximize extortion leverage.

Technical Deep Dive

CVE-2026-41940 affects cPanel and WHM versions subsequent to 11.40. The vulnerability resides in the HTTP Basic Authentication handling within the cpsrvd daemon’s login flow, specifically manifesting as a Carriage Return Line Feed (CRLF) injection combined with a session file dual-storage race condition.

The Vulnerability Mechanics

The cpsrvd daemon manages session data by storing it in two parallel formats: a raw text file and a JSON cache.

1. Injection: An unauthenticated attacker initiates a login request and injects crafted CRLF sequences (\r\n) into the HTTP Basic Authentication headers.
2. Session Manipulation: These sequences are improperly sanitized and written directly into the pre-authentication raw text session file.
3. Re-parsing & Privilege Escalation: When cpsrvd re-parses the raw text file to synchronize with the JSON cache, the injected CRLF characters force the parser to interpret the attacker’s payload as top-level session directives.

By injecting specific key-value pairs, the attacker artificially promotes the pre-authentication session to a fully authenticated root session. The standard authentication code path—including password verification and Two-Factor Authentication (2FA)—is entirely bypassed.

Exploit Payload Parameters:

user=root hasroot=1 tfa_verified=1

Post-Exploitation & The ‘Sorry’ Ransomware

Upon achieving root access, attackers rapidly deploy the ‘Sorry’ ransomware.

• Architecture: A custom, Go-based Linux encryptor.
• Cryptography: Utilizes the ChaCha20 stream cipher for rapid file encryption, securing the symmetric keys with an embedded RSA-2048 public key.
• Indicators: Encrypted files are appended with a .sorry extension, accompanied by a dropped ransom note in affected directories.

To ensure operational security during encryption, attackers deploy the libcow.so rootkit. This userland rootkit hooks system calls to hide malicious processes and actively blocks network recovery tools such as curl and wget, severely hindering incident response efforts.

Impact & Analysis

Successful exploitation of CVE-2026-41940 results in a total compromise of the host system. The impact extends far beyond the WHM interface, granting attackers unrestricted access to the underlying Linux operating system and all hosted tenant environments.

Attackers are establishing deep, redundant persistence mechanisms on compromised hosts to survive reboots and initial remediation attempts. Observed Tactics, Techniques, and Procedures (TTPs) include:

• Account Creation: Generating unauthorized UID-0 (root-equivalent) backdoor accounts in /etc/passwd.
• SSH Manipulation: Appending rogue SSH public keys to /root/.ssh/authorized_keys.
• WHM Abuse: Creating fake cPanel reseller accounts with elevated privileges.
• Webshells: Distributing obfuscated PHP webshells across various customer web directories.

For MSPs, a single compromised WHM server can lead to the simultaneous breach of hundreds of client environments, resulting in catastrophic reputational damage, data loss, and regulatory penalties.

Actionable Defense & Remediation

1. Immediate Patching (Primary Directive)

Administrators must immediately upgrade cPanel and WHM to a patched release.

• Target Version: Update to version 11.136.1.7 or higher.
• Verify the update via the WHM interface or by running /usr/local/cpanel/scripts/upcp from the CLI.

2. Network Access Restrictions (Mitigation)

If immediate patching is not feasible, restrict access to all cPanel/WHM management ports at the network firewall level. Do not expose these ports to the public internet.

• Affected Ports: 2082, 2083, 2086, 2087, 2095, 2096
• Action: Implement strict allow-lists (ACLs) permitting access only from trusted, administrative IP addresses or dedicated management VPNs.

3. Threat Hunting & Compromise Detection

Security teams must proactively hunt for indicators of compromise (IOCs) related to session manipulation and persistence.

Detecting Session Manipulation:
Audit the raw session directory for injected privilege escalation parameters. Run the following command to identify manipulated pre-authentication files:

grep -E "user=root|hasroot=1|tfa_verified=1" /var/cpanel/sessions/raw/*

Note: Any hits from this command on unauthenticated or unexpected session files indicate a highly probable compromise.

Hunting for Persistence:
Execute the following checks to identify post-exploitation activity:

# Check for unauthorized SSH keys cat /root/.ssh/authorized_keys # Audit for unexpected UID-0 users awk -F: '($3 == "0") {print}' /etc/passwd # Check for the libcow.so rootkit presence find / -name "libcow.so" 2>/dev/null grep -i "libcow.so" /etc/ld.so.preload

• Additionally, audit WHM for newly created, unrecognized reseller accounts and inspect system cron jobs (crontab -l and /etc/cron.*) for malicious callbacks.

4. System Hardening

• Enforce 2FA: While this vulnerability bypasses 2FA, enforcing it globally on the WHM root account remains a critical defense-in-depth measure against credential stuffing.
• Disable SSH Password Authentication: Modify /etc/ssh/sshd_config to set PasswordAuthentication no and PermitRootLogin prohibit-password, enforcing key-based access exclusively.

References

• Arctic Wolf: CVE-2026-41940: Critical Exploited Authentication Bypass Vulnerability
• Bleeping Computer: Critical cPanel flaw mass-exploited in Sorry ransomware attacks
• CVE.org: CVE-2026-41940
• Hadrian.io: CVE-2026-41940: A Critical Authentication Bypass in cPanel
• Help Net Security: Multiple threat actors actively exploit cPanel vulnerability
• IBM X-Force: The cPanel Crisis
• Imperva: Imperva Customers Protected Against CVE-2026-41940
• Reddit (NetSec): ELI5: What Exactly is the cPanel Exploit
• Trend Micro: SECURITY ALERT: Critical Authentication Bypass in cPanel & WHM