The CVE-2026-41940 cpanel Exploit

What Happened With the Recent cPanel Security Vulnerability?

On April 28, 2026, cPanel released an important security update for cPanel & WHM and WP Squared after a serious vulnerability was discovered in the software. The vulnerability is now tracked as CVE-2026-41940 and has been widely reported as a critical authentication bypass issue affecting cPanel & WHM installations. cPanel confirmed that the issue affected cPanel software, including DNSOnly, on versions after 11.40.

Because cPanel and WHM are used across a large part of the web hosting industry, this quickly became a major concern for hosting providers, server administrators, and website owners. TechCrunch reported that attackers were actively exploiting the bug and that the issue could allow hackers to bypass the normal login process and gain access to the administration panel of affected systems.

At OrangeWebsite, we treated this as a high-priority security event from the moment it was disclosed. The vulnerability was disclosed late on April 28, and we announced it to our clients early on April 29. We also patched all shared hosting machines and system nodes as quickly as possible to protect customers on OrangeWebsite-managed infrastructure.

What Was the cPanel Vulnerability?

In simple terms, this vulnerability affected the login process of cPanel & WHM.

Normally, to access cPanel or WHM, a user needs valid login details. That means a username, password, and in many cases, additional security checks such as two-factor authentication. This vulnerability created a way for attackers to bypass that normal authentication process under certain conditions.

That is why this type of vulnerability is called an authentication bypass.

An authentication bypass is dangerous because it does not work like a normal password attack. The attacker does not necessarily need to know your password, guess your password, or trick you into giving it away. Instead, the attacker takes advantage of a flaw in how the software handles the login or session process.

Security researchers described CVE-2026-41940 as a critical issue because successful exploitation could allow an unauthenticated remote attacker to gain unauthorized administrative access to affected cPanel & WHM systems. Rapid7 noted that cPanel & WHM provides server-level administration, meaning a successful compromise could affect websites, databases, configurations, and accounts managed through that server.

Why Was This So Serious?

cPanel and WHM are not just simple website dashboards. They are powerful tools used to manage hosting accounts, websites, email accounts, files, DNS settings, databases, SSL certificates, and server-level configurations.

For a normal website owner, cPanel is often the place where they manage their website files, email accounts, redirects, backups, and databases.

For a server administrator or hosting company, WHM is even more powerful. WHM can manage multiple cPanel accounts on the same server. This means that if an attacker gains high-level access to WHM, the risk can extend beyond one single website.

That is why this vulnerability was treated as urgent across the hosting industry. TechCrunch reported that cPanel & WHM are widely used by hosting companies and website owners around the world, and that the affected software has deep access to the servers it manages.

In practical terms, a successful attack could potentially allow a hacker to interfere with hosted websites, access sensitive files, change configurations, create unauthorized access, or compromise customer accounts on an affected server.

How Did the Exploit Happen?

The technical details are complex, but the simple explanation is this:

The vulnerability was connected to how cPanel handled login sessions. A session is what tells the system, “this user has logged in successfully and is allowed to access this area.”

When you log into a website, control panel, or online account, the server usually creates a session for you. That session helps the system remember that you are already logged in, so you do not have to enter your password again on every single page.

In this case, the flaw allowed attackers to interfere with the session process in a way that could make the system treat them as authenticated when they should not have been.

Some technical writeups describe the issue as involving CRLF injection and session handling, but the important point for customers is simpler: attackers found a way to abuse the login/session system to get access without going through the normal login process. Rapid7 described the vulnerability as an authentication bypass caused by a CRLF injection in the login and session loading processes of cPanel & WHM.

This is also why patching was so important. The fix needed to happen at the software level. Changing a website password alone would not fix the underlying vulnerability if the server itself was still running an affected version of cPanel.

Who Was Affected?

According to cPanel’s advisory, the vulnerability affected cPanel software, including DNSOnly, on versions after 11.40. cPanel released patched versions across multiple supported cPanel & WHM versions and also released a patch for WP Squared.

The main risk applied to servers running affected versions of cPanel & WHM that had not yet been patched.

For OrangeWebsite shared hosting customers, we patched the shared hosting environment and system nodes quickly after the disclosure. Customers on fully managed OrangeWebsite infrastructure did not need to manually apply the cPanel update themselves.

However, some customers using their own VPS, dedicated server, or self-managed environment may have needed to apply the patch manually. Unfortunately, some clients who did not apply the patch immediately appear to have been affected by late April 30.