cPanel had a strange design decision for years.
A user tries to log in and fails. But even after that failed attempt, cpsrvd (the service’s daemon) writes a session file to disk.
A pre-authentication session. This detail has been quietly exploited since February 2026. Now it’s called CVE-2026-41940 and its CVSS score is 9.8.
At the heart of it is a CRLF injection. When special characters (\r\n) are slipped into the Authorization header, cpsrvd’s session load/save flow doesn’t sanitize them.
With this payload, manipulated through the cookie, the attacker gets parameters of their own choosing written into the session file. In plain text.
Then they get the file reloaded and log in with credentials they “wrote themselves”.
The auth bypass is complete.
watchTowr’s blog post covers the chaining part in detail: the vulnerability isn’t just CRLF, because the injection on its own wouldn’t be this destructive.
The real issue is that cpsrvd treats this pre-auth session file as trusted.
So without knowing any credentials, the attacker injects a session and the system accepts it.
The first place to look when checking your environment is the cPanel version. All versions after v11.40 are affected, which means almost everything:
/usr/local/cpanel/cpanel -VcPanel & WHM’s open ports are 2082, 2083, 2086, 2087 by default. To quickly see whether they’re exposed to the outside:
nmap -p 2082,2083,2086,2087 -sV target-ipIf you’re a hosting provider or run your own servers, check the Update Preferences section in the whostmgr panel. Automatic updates should be on.
cPanel released the patch (11.124.0.6 and later). Moving to a patched version is the only consistent fix right now.
For emergency mitigation, closing the panel ports to the internet and putting them behind a VPN works.
Looking at Shodan, about 1.5 million cPanel instances are exposed.
If even half of them are unpatched, that’s a huge attack surface.
The really unsettling part of this flaw is this: the moment the PoC came out, something that had already been exploited for months spread to the whole community.
So there’s a high chance that some of the sysadmins saying “it doesn’t affect us” have already been compromised. Scanning your logs retroactively is a must.
Demo video: watch it on eminuzun.com
Sources:
https://nvd.nist.gov/vuln/detail/CVE-2026-41940
https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/