Threat reportVulnerabilityTL-2026-4956
cPanel & WHM Authentication Bypass via CRLF Session Injection (CVE-2026-41940) Exploited as Zero-Day and Mass-Exploited for Sorry Ransomware
cPanel & WHM Authentication Bypass via CRLF Session (TL-2026-4956), also tracked as cPanel WHM CRLF session injection auth bypass, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-11-01. It has no confirmed attribution, affects WebPros cPanel & WHM, references 1 CVE (CVE-2026-41940), maps to 13 MITRE ATT&CK techniques (T1053.003, T1098, T1098.004), and is covered by 9 detection rules and 10 indicators of compromise.
- CVSS
- 9.8/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 13MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 10Indicators of compromise
Key facts for TL-2026-4956
- Threat ID
- TL-2026-4956
- Also known as
- cPanel WHM CRLF session injection auth bypass, Sorry ransomware campaign (cPanel)
- Severity
- CRITICAL
- CVSS
- 9.8
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- hosting providers, managed service providers, government administration, military, web hosting customers
- Target regions
- Global, South-East Asia, philippines, laos, North America, south africa
- Detection rules
- 9
- Indicators of compromise
- 10
Malware and tooling in cPanel & WHM Authentication Bypass via CRLF Session
Malware and tooling: Mirai, Sorry ransomware, nuclear.x86, Mirai, watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py
How cPanel & WHM Authentication Bypass via CRLF Session works
CVE-2026-41940 is a pre-authentication bypass in cPanel & WHM (cpsrvd) that chains an HTTP Basic Authorization header carrying CRLF characters with a malformed whostmgrsession cookie to forge a root session and skip password and 2FA checks. It was exploited in the wild from at least 2026-02-23, two months before the 2026-04-28 patch, and was later used by multiple actors for Sorry ransomware, Mirai botnet deployment and espionage.
CVE-2026-41940 (CWE-306, reported CVSS 9.8) affects cPanel & WHM and WP Squared. The flaw is in the session handling of cpsrvd. In the Basic authentication handler the attacker-supplied password is passed through set_pass(), which strips only null bytes, and is then stored in the session record via saveSession(). The vendor fix moved the filter_sessiondata() call, which strips CR and LF, into saveSession(), but the Basic-auth code path had bypassed that protection.
WatchTower Labs documented the exploit chain. Step 1: the attacker sends a failed login (POST /login/?login_only=1 to the WHM port 2087) to obtain a pre-authentication whostmgrsession cookie. Step 2: the attacker sends a request with that session cookie truncated, with the ',<obhex>' suffix removed, plus an Authorization: Basic header whose decoded password contains embedded \r\n sequences (for example hasroot=1, tfa_verified=1, user=root, cp_security_token=/cpsessNNNNNNNNNN, successful_internal_auth_with_timestamp=<epoch>). Because get_ob_part() finds no obhex, the session encoder skips encryption and the injected newlines reach /var/cpanel/sessions/raw/<id> in plaintext. Step 3: the attacker requests a protected path such as /scripts2/listaccts without a security token. This triggers do_token_denied(), which reloads the raw session file with nocache and writes the JSON cache, so the CRLF-delimited lines become top-level session keys. Step 4: later requests load the poisoned cache in /var/cpanel/sessions/cache/<id>. docheckpass_whostmgrd() skips password validation when successful_internal_auth_with_timestamp is present, so the attacker is treated as authenticated root with 2FA satisfied.
KnownHost reported in-the-wild exploitation dating to at least 2026-02-23. The flaw was reportedly disclosed to cPanel around 2026-04-14. cPanel published its advisory and patches on 2026-04-28, watchTowr published its analysis and a public PoC / detection artifact generator on 2026-04-29, and CISA added the CVE to the KEV catalog on 2026-04-30. Shadowserver observed more than 44,000 unique cPanel IPs scanning, exploiting or being compromised, and roughly 1.4-1.5 million cPanel instances are internet-exposed (Shodan/Rapid7).
Reported post-exploitation by multiple independent actors includes: the Go-based Linux Sorry ransomware (ChaCha20 with RSA-2048-protected key, .sorry extension, backup wiping, Tox contact), with Censys identifying 8,859 hosts exposing open directories of .sorry files (7,135 running cPanel/WHM); a separate 0.1 BTC extortion and defacement variant; the Mirai variant nuclear.x86 with admin account creation, disabled security logging, firewall changes, cryptomining and DDoS clients; webshells and credential harvesting (crypto wallets, AWS keys, API tokens); SSH key persistence, hidden cron jobs, API tokens and sudoers backdoors; and a Ctrl-Alt-Intel-reported espionage campaign against government, military, MSP and hosting targets in the Philippines, Laos and elsewhere in South-East Asia. Sources differ on the exact affected version lists; this record uses the union of the watchTowr and Arctic Wolf lists.
MITRE ATT&CK techniques used in TL-2026-4956
Persistence
T1053.003 Scheduled Task/Job: Cron; T1098 Account Manipulation; T1098.004 Account Manipulation: SSH Authorized Keys; T1136.001 Create Account: Local Account; T1505.003 Server Software Component: Web Shell
Initial Access
T1190 Exploit Public-Facing Application
Impact
T1490 Inhibit System Recovery; T1496 Resource Hijacking
Privilege Escalation
T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching
Credential Access
defense-impairment
T1556 Modify Authentication Process; T1685 Disable or Modify Tools; T1686 Disable or Modify System Firewall
Affected products and versions in cPanel & WHM Authentication Bypass via CRLF Session
- WebPros — cPanel & WHM
Vulnerable versions: prior to 11.86.0.41; 11.110.0.96 and earlier; 11.118.0.61 and earlier; 11.126.0.53 and earlier; prior to 11.130.0.19; 11.132.0.27 and earlier; 11.134.0.19 and earlier; 11.136.0.4 and earlier
Fixed in: 11.86.0.41; 11.110.0.97; 11.118.0.63; 11.126.0.54; 11.130.0.19; 11.132.0.29; 11.134.0.20; 11.136.0.5 - WebPros — WP Squared
Vulnerable versions: prior to 136.1.7
Fixed in: 136.1.7
Remediation for cPanel & WHM Authentication Bypass via CRLF Session
Patches
- 11.86.0.41
- 11.110.0.97
- 11.118.0.63
- 11.126.0.54
- 11.130.0.19
- 11.132.0.29
- 11.134.0.20
- 11.136.0.5
- WP Squared 136.1.7
Immediate actions
- Update to a fixed build and verify with /usr/local/cpanel/cpanel -V, then restart cpsrvd
- Block or restrict inbound access to cPanel/WHM ports 2083, 2087, 2095 and 2096 until patched
- Run cPanel's published detection script and review /var/cpanel/sessions/raw/ for injected user=root, hasroot=1, tfa_verified=1, successful_internal_auth_with_timestamp and multiple pass= lines
- Audit for unexpected SSH authorized_keys, cron jobs, API tokens, sudoers entries, new admin accounts and webshells
Workarounds
- Stop cpsrvd and cpdavd services if patching must be delayed
- Firewall ports 2083/2087/2095/2096
Longer-term hardening
- Do not expose WHM/cPanel management ports to the internet; require VPN or IP allowlisting
- Monitor Authorization: Basic headers containing control characters and requests to /scripts2/ endpoints without a cpsess token
- Keep offline, immutable backups; rebuild from clean backups when compromise is confirmed
CVEs associated with cPanel & WHM Authentication Bypass via CRLF Session
Weaknesses (CWE) in cPanel & WHM Authentication Bypass via CRLF Session
Timeline of cPanel & WHM Authentication Bypass via CRLF Session
- KnownHost confirms earliest in-the-wild exploitation of CVE-2026-41940 as a zero-day, roughly two months before a patch was available.
- Vulnerability reportedly disclosed to cPanel about two weeks before the public advisory (approximate date; reported by Help Net Security).
- cPanel/WebPros publishes its security advisory and releases fixed builds including 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29 and 11.134.0.20.
- watchTowr Labs publishes the root-cause analysis of the CRLF session injection chain and a public PoC / detection artifact generator.
- CISA adds CVE-2026-41940 to the Known Exploited Vulnerabilities catalog; Shadowserver reports 44,000+ cPanel IPs compromised or scanning/exploiting.
- Ctrl-Alt-Intel identifies an espionage campaign using CVE-2026-41940 against government, military, MSP and hosting targets in South-East Asia.
- Censys reports multiple independent actors exploiting the flaw, including Sorry ransomware (8,859 hosts with open .sorry directories; 7,135 cPanel/WHM) and Mirai variant nuclear.x86.
Sources cited for cPanel & WHM Authentication Bypass via CRLF Session
- The Internet Is Falling Down, Falling Down, Falling Down (cPanel & WHM Authentication Bypass CVE-2026-41940)
- cPanel: Critical Vulnerability with cPanel & WHM Login Authentication
- watchTowr PoC / Detection Artifact Generator
- Help Net Security: cPanel zero-day exploited for months before patch release
- Help Net Security: Multiple threat actors actively exploit cPanel vulnerability
- Arctic Wolf Security Bulletin: CVE-2026-41940
- CybelAngel: cPanel zero-day hits 44,000 servers in mass Sorry ransomware campaign
- GovInfoSecurity: Ransomware-Wielding Attackers Target cPanel, WHM Software
- Canadian Centre for Cyber Security: cPanel security advisory (AV26-404)
- CIRCL GCVE record for CVE-2026-41940
Detection coverage for TL-2026-4956
As of 2026-11-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4956 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.