# cPanel & WHM Authentication Bypass via CRLF Session Injection (CVE-2026-41940) Exploited as Zero-Day and Mass-Exploited for Sorry Ransomware

> CVE-2026-41940 is a pre-authentication bypass in cPanel & WHM (cpsrvd) that chains an HTTP Basic Authorization header carrying CRLF characters with a malformed whostmgrsession cookie to forge a root session and skip password and 2FA checks. It was exploited in the wild from at least 2026-02-23, two months before the 2026-04-28 patch, and was later used by multiple actors for Sorry ransomware, Mirai botnet deployment and espionage.

- **Published:** 2026-11-01T03:42:25Z
- **Last reviewed:** 2026-11-01T03:42:25Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4956
- **ID:** TL-2026-4956
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-41940

## Description

CVE-2026-41940 (CWE-306, reported CVSS 9.8) affects cPanel & WHM and WP Squared. The flaw is in the session handling of cpsrvd. In the Basic authentication handler the attacker-supplied password is passed through set_pass(), which strips only null bytes, and is then stored in the session record via saveSession(). The vendor fix moved the filter_sessiondata() call, which strips CR and LF, into saveSession(), but the Basic-auth code path had bypassed that protection.

WatchTower Labs documented the exploit chain. Step 1: the attacker sends a failed login (POST /login/?login_only=1 to the WHM port 2087) to obtain a pre-authentication whostmgrsession cookie. Step 2: the attacker sends a request with that session cookie truncated, with the ',<obhex>' suffix removed, plus an Authorization: Basic header whose decoded password contains embedded \r\n sequences (for example hasroot=1, tfa_verified=1, user=root, cp_security_token=/cpsessNNNNNNNNNN, successful_internal_auth_with_timestamp=<epoch>). Because get_ob_part() finds no obhex, the session encoder skips encryption and the injected newlines reach /var/cpanel/sessions/raw/<id> in plaintext. Step 3: the attacker requests a protected path such as /scripts2/listaccts without a security token. This triggers do_token_denied(), which reloads the raw session file with nocache and writes the JSON cache, so the CRLF-delimited lines become top-level session keys. Step 4: later requests load the poisoned cache in /var/cpanel/sessions/cache/<id>. docheckpass_whostmgrd() skips password validation when successful_internal_auth_with_timestamp is present, so the attacker is treated as authenticated root with 2FA satisfied.

KnownHost reported in-the-wild exploitation dating to at least 2026-02-23. The flaw was reportedly disclosed to cPanel around 2026-04-14. cPanel published its advisory and patches on 2026-04-28, watchTowr published its analysis and a public PoC / detection artifact generator on 2026-04-29, and CISA added the CVE to the KEV catalog on 2026-04-30. Shadowserver observed more than 44,000 unique cPanel IPs scanning, exploiting or being compromised, and roughly 1.4-1.5 million cPanel instances are internet-exposed (Shodan/Rapid7).

Reported post-exploitation by multiple independent actors includes: the Go-based Linux Sorry ransomware (ChaCha20 with RSA-2048-protected key, .sorry extension, backup wiping, Tox contact), with Censys identifying 8,859 hosts exposing open directories of .sorry files (7,135 running cPanel/WHM); a separate 0.1 BTC extortion and defacement variant; the Mirai variant nuclear.x86 with admin account creation, disabled security logging, firewall changes, cryptomining and DDoS clients; webshells and credential harvesting (crypto wallets, AWS keys, API tokens); SSH key persistence, hidden cron jobs, API tokens and sudoers backdoors; and a Ctrl-Alt-Intel-reported espionage campaign against government, military, MSP and hosting targets in the Philippines, Laos and elsewhere in South-East Asia. Sources differ on the exact affected version lists; this record uses the union of the watchTowr and Arctic Wolf lists.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1556 Modify Authentication Process
- T1098.004 Account Manipulation: SSH Authorized Keys
- T1053.003 Scheduled Task/Job: Cron
- T1505.003 Server Software Component: Web Shell
- T1136.001 Create Account: Local Account
- T1098 Account Manipulation
- T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching
- T1686 Disable or Modify System Firewall
- T1685 Disable or Modify Tools
- T1552 Unsecured Credentials
- T1490 Inhibit System Recovery
- T1496 Resource Hijacking

## Sources

- [The Internet Is Falling Down, Falling Down, Falling Down (cPanel & WHM Authentication Bypass CVE-2026-41940)](https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/)
- [cPanel: Critical Vulnerability with cPanel & WHM Login Authentication](https://support.cpanel.net/hc/en-us/articles/40073787579671-Critical-Vulnerability-with-cPanel-WHM-Login-Authentication)
- [watchTowr PoC / Detection Artifact Generator](https://github.com/watchtowrlabs/watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py)
- [Help Net Security: cPanel zero-day exploited for months before patch release](https://helpnetsecurity.com/2026/04/30/cpanel-zero-day-vulnerability-cve-2026-41940-exploited/)
- [Help Net Security: Multiple threat actors actively exploit cPanel vulnerability](https://www.helpnetsecurity.com/2026/05/04/multiple-threat-actors-actively-exploit-cpanel-vulnerability-cve-2026-41940/)
- [Arctic Wolf Security Bulletin: CVE-2026-41940](https://arcticwolf.com/resources/blog/cve-2026-41940)
- [CybelAngel: cPanel zero-day hits 44,000 servers in mass Sorry ransomware campaign](https://cybelangel.com/blog/cve-2026-41940-mass-cpanel-attack-hits-40-000-servers/)
- [GovInfoSecurity: Ransomware-Wielding Attackers Target cPanel, WHM Software](https://www.govinfosecurity.com/ransomware-wielding-attackers-target-cpanel-whm-software-a-31598)
- [Canadian Centre for Cyber Security: cPanel security advisory (AV26-404)](https://cyber.gc.ca/en/alerts-advisories/cpanel-security-advisory-av26-404)
- [CIRCL GCVE record for CVE-2026-41940](https://cve.circl.lu/cve/CVE-2026-41940)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4956