cPanel/WHM auth bypass enables unauthenticated RCE
cPanel/WHM authentication bypass (CVE-2026-41940) enables unauthenticated RCE; actively exploited since February 2026 with ransomware and botnet deployment.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-41940 as exploited in the wild.
A critical authentication bypass vulnerability (CVE-2026-41940) in cPanel & WHM versions 11.40 and later allows unauthenticated remote attackers to gain full administrative access and execute arbitrary code with root privileges. The exploit requires only a few HTTP requests and no credentials, providing complete WHM API access. According to KnownHost CEO Daniel Pearson, threat actors began exploiting this vulnerability on February 23, 2026—approximately two months before cPanel issued an emergency patch on April 28, 2026.
Following public disclosure by watchTowr Labs with proof-of-concept code, exploitation has escalated significantly. Attackers have deployed the "Sorry" ransomware campaign using a Go-based Linux encryptor, installed Mirai botnet variants, harvested credentials, and conducted cyber espionage operations targeting government and military entities in Southeast Asia. Shadowserver identified 44,000 IP addresses engaged in active scanning and exploitation of vulnerable cPanel instances.
MS-ISAC assesses this as a critical risk to all sectors relying on cPanel/WHM infrastructure, particularly hosting providers and organizations with internet-exposed web management interfaces. CISA has added CVE-2026-41940 to its Known Exploited Vulnerabilities catalog. Immediate patching is essential, as the vulnerability affects multiple major version branches and WP Squared installations.
Mentioned in this report
Detection guidance
Shell or Interpreter Spawned from cPanel/WHM Service Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a shell or scripting interpreter spawned as a child of cpsrvd/whostmgr, consistent with RCE via the cPanel/WHM authentication bypass (CVE-2026-41940). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Shell or Interpreter Spawned from cPanel/WHM Service Process
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /cpsrvd
- /whostmgr
- /cpanel
- /cpsrvd-ssl
Image|endswith:
- /sh
- /bash
- /dash
- /perl
- /python
- /python3
- /curl
- /wget
filter:
CommandLine|contains:
- /usr/local/cpanel/scripts/
- /usr/local/cpanel/bin/
condition: selection and not filter
falsepositives:
- Legitimate cPanel maintenance scripts invoking system helper binaries from known
cPanel script paths
- Backup or license verification cron jobs executed by cpsrvd on schedule
level: high
tags:
- attack.t1190
- attack.execution
id: dcc0a945-d08a-5e05-8f1f-558f87bb2858
status: experimental
author: Vorant
Download-and-Execute Chain Following Web Service Exploitation
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a common post-exploitation pattern of downloading a file with curl/wget then making it executable and running it, typical of Mirai or ransomware payload staging after cPanel/WHM RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Download-and-Execute Chain Following Web Service Exploitation
logsource:
category: process_creation
product: linux
detection:
selection_download:
Image|endswith:
- /curl
- /wget
CommandLine|re: (?i)(http|https|ftp)://[^ ]+
selection_chmod:
Image|endswith: /chmod
CommandLine|contains: +x
selection_parent_web:
ParentImage|endswith:
- /cpsrvd
- /whostmgr
- /cpanel
- /httpd
- /apache2
- /nginx
condition: (selection_download or selection_chmod) and selection_parent_web
falsepositives:
- Automated software update scripts running under the web server user that legitimately
fetch and apply patches
- Custom cPanel plugin installers that download and set executable permissions as
part of normal operation
level: high
tags:
- attack.t1190
- attack.command-and-control
- attack.execution
id: 1f358ea1-c7bf-56c4-ae68-f1d1a01fe6d3
status: experimental
author: Vorant
Unusual Executable Launched from Temp Directory by Web Service Account
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects execution of a binary from a world-writable temp directory by the web server or cPanel service account, consistent with dropper/ransomware/botnet payload execution after exploiting the cPanel/WHM auth bypass. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unusual Executable Launched from Temp Directory by Web Service Account
logsource:
category: process_creation
product: linux
detection:
selection:
Image|startswith:
- /tmp/
- /var/tmp/
- /dev/shm/
selection_user:
User|contains:
- nobody
- cpanel
- cpses
- www-data
- apache
condition: selection and selection_user
falsepositives:
- Legitimate temporary script execution by monitoring agents that run as the web service
account
- Package manager or cPanel update processes that stage binaries in /tmp during upgrades
level: medium
tags:
- attack.t1190
- attack.execution
id: a2405d08-71f7-54fa-a9e5-df45961e9962
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-whm-cpanel-and-wp-squared-could-allow-for-remote-code-execution_2026-042
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs, malware, and campaigns it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs