cPanel/WHM auth bypass enables unauthenticated RCE
cPanel/WHM authentication bypass (CVE-2026-41940) enables unauthenticated RCE; actively exploited since February 2026 with ransomware and botnet deployment.
A critical authentication bypass vulnerability (CVE-2026-41940) in cPanel & WHM versions 11.40 and later allows unauthenticated remote attackers to gain full administrative access and execute arbitrary code with root privileges. The exploit requires only a few HTTP requests and no credentials, providing complete WHM API access. According to KnownHost CEO Daniel Pearson, threat actors began exploiting this vulnerability on February 23, 2026—approximately two months before cPanel issued an emergency patch on April 28, 2026.
Following public disclosure by watchTowr Labs with proof-of-concept code, exploitation has escalated significantly. Attackers have deployed the "Sorry" ransomware campaign using a Go-based Linux encryptor, installed Mirai botnet variants, harvested credentials, and conducted cyber espionage operations targeting government and military entities in Southeast Asia. Shadowserver identified 44,000 IP addresses engaged in active scanning and exploitation of vulnerable cPanel instances.
MS-ISAC assesses this as a critical risk to all sectors relying on cPanel/WHM infrastructure, particularly hosting providers and organizations with internet-exposed web management interfaces. CISA has added CVE-2026-41940 to its Known Exploited Vulnerabilities catalog. Immediate patching is essential, as the vulnerability affects multiple major version branches and WP Squared installations.
Mentioned in this report
Detection guidance
Shell or Interpreter Spawned from cPanel/WHM Service Process
Detects a shell or scripting interpreter spawned as a child of cpsrvd/whostmgr, consistent with RCE via the cPanel/WHM authentication bypass (CVE-2026-41940). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Shell or Interpreter Spawned from cPanel/WHM Service Process
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /cpsrvd
- /whostmgr
- /cpanel
- /cpsrvd-ssl
Image|endswith:
- /sh
- /bash
- /dash
- /perl
- /python
- /python3
- /curl
- /wget
filter:
CommandLine|contains:
- /usr/local/cpanel/scripts/
- /usr/local/cpanel/bin/
condition: selection and not filter
falsepositives:
- Legitimate cPanel maintenance scripts invoking system helper binaries from known
cPanel script paths
- Backup or license verification cron jobs executed by cpsrvd on schedule
level: high
tags:
- attack.t1190
- attack.execution
id: dcc0a945-d08a-5e05-8f1f-558f87bb2858
status: experimental
author: Vorant
Download-and-Execute Chain Following Web Service Exploitation
Detects a common post-exploitation pattern of downloading a file with curl/wget then making it executable and running it, typical of Mirai or ransomware payload staging after cPanel/WHM RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Download-and-Execute Chain Following Web Service Exploitation
logsource:
category: process_creation
product: linux
detection:
selection_download:
Image|endswith:
- /curl
- /wget
CommandLine|re: (?i)(http|https|ftp)://[^ ]+
selection_chmod:
Image|endswith: /chmod
CommandLine|contains: +x
selection_parent_web:
ParentImage|endswith:
- /cpsrvd
- /whostmgr
- /cpanel
- /httpd
- /apache2
- /nginx
condition: (selection_download or selection_chmod) and selection_parent_web
falsepositives:
- Automated software update scripts running under the web server user that legitimately
fetch and apply patches
- Custom cPanel plugin installers that download and set executable permissions as
part of normal operation
level: high
tags:
- attack.t1190
- attack.command_and_control
- attack.execution
id: 1f358ea1-c7bf-56c4-ae68-f1d1a01fe6d3
status: experimental
author: Vorant
Unusual Executable Launched from Temp Directory by Web Service Account
Detects execution of a binary from a world-writable temp directory by the web server or cPanel service account, consistent with dropper/ransomware/botnet payload execution after exploiting the cPanel/WHM auth bypass. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unusual Executable Launched from Temp Directory by Web Service Account
logsource:
category: process_creation
product: linux
detection:
selection:
Image|startswith:
- /tmp/
- /var/tmp/
- /dev/shm/
selection_user:
User|contains:
- nobody
- cpanel
- cpses
- www-data
- apache
condition: selection and selection_user
falsepositives:
- Legitimate temporary script execution by monitoring agents that run as the web service
account
- Package manager or cPanel update processes that stage binaries in /tmp during upgrades
level: medium
tags:
- attack.t1190
- attack.execution
- attack.defense_evasion
id: a2405d08-71f7-54fa-a9e5-df45961e9962
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-whm-cpanel-and-wp-squared-could-allow-for-remote-code-execution_2026-042
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free