• New critical severity vulnerability allows for authentication bypass
• The vulnerability affects cPanel and WebHost Manager
• Attackers can gain full root administrator privileges over any server

Researchers at watchTowr Labs have dissected a critical authentication bypass in cPanel and Web Host Manager (WHM) that allows remote attackers to gain full admin access over servers upon which much of the internet relies.

The vulnerability, tracked as CVE-2026-41940 and given a near-top severity score of 9.8, has been exploited in the wild, as confirmed by KnownHost.

A patch for the vulnerability has been released and administrators are urged to apply the patch immediately.

Article continues below

For those not aware, cPanel is a layer of software that essentially acts as the control panel for a website. Rather than using code, cPanel is the button that allows you to update some text or upload a file onto a website. cPanel is also where the layout and data of your website is stored. WHM on the other hand is what handles every website at the server level.

The crux of the vulnerability lies in the attacker forging an authenticated session without requiring a password. This provides the attacker with root level access to WHM, and therefore access to every website, database, and user account hosted on that particular server.

From here, there are many options for an attacker. They could steal all of your website and user data, upload malware - or they could simply delete everything on the server.

As explained by watchTowr Labs (in their characteristic quirky format), the exploit relies on the attacker using CRLF (Carriage Return Line Feed) to inject a new line of code into the cPanel Logbook that bypasses session file encryption and establishes the attacker as the root administrator, giving the attacker access to the WHM admin panel and therefore access to the server. (If you want an even more technical breakdown, see the watchTowr Labs report).

The patch for the vulnerability has also added a new ‘sanitization’ function that scrubs any data you send to the server, preventing new lines of code from being snuck in.

For administrators, cPanel recommends updating to the following versions:

• cPanel & WHM 110.0.x - patched in 11.110.0.97 (was 11.110.0.96)
• cPanel & WHM 118.0.x - patched in 11.118.0.63 (was 11.118.0.61)
• cPanel & WHM 126.0.x - patched in 11.126.0.54 (was 11.126.0.53)
• cPanel & WHM 132.0.x - patched in 11.132.0.29 (was 11.132.0.27)
• cPanel & WHM 134.0.x - patched in 11.134.0.20 (was 11.134.0.19)
• cPanel & WHM 136.0.x - patched in 11.136.0.5 (was 11.136.0.4)

Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.

Benedict is a Senior Security Writer at TechRadar Pro, where he has specialized in covering the intersection of geopolitics, cyber-warfare, and business security.

Benedict provides detailed analysis on state-sponsored threat actors, APT groups, and the protection of critical national infrastructure, with his reporting bridging the gap between technical threat intelligence and B2B security strategy.

Benedict holds an MA (Distinction) in Security, Intelligence, and Diplomacy from the University of Buckingham Centre for Security and Intelligence Studies (BUCSIS), with his specialization providing him with a robust academic framework for deconstructing complex international conflicts and intelligence operations, and the ability to translate intricate security data into actionable insights.