CVE-2026-41940: Critical cPanel Auth Bypass Is Being Actively Ransomwared — CISA Deadline Is Today

If you run cPanel or WHM and haven’t patched yet, stop reading and run /scripts/upcp --force right now. CISA’s federal patching deadline for CVE-2026-41940 is today, May 3, 2026.

What the vulnerability is

CVE-2026-41940 is a CRLF (Carriage Return Line Feed) injection flaw in the login and session-loading code of cPanel, WHM, and WP Squared. An unauthenticated attacker manipulates the whostmgrsession cookie to inject user=root directly into their server-side session file, bypassing authentication entirely. The CVSS 3.1 score is 9.8 — critical.

The attack requires no credentials, no race condition, and no prior foothold on the system. A public proof-of-concept has been circulating since late February 2026, which is when mass exploitation began.

The damage so far

Approximately 44,000 cPanel IP addresses have been confirmed compromised in attacks linked to the “Sorry” ransomware campaign. The threat actors automated exploitation at scale — the PoC is that reliable. Shodan puts roughly 1.5 million cPanel instances on the public internet, which means the attack surface remains enormous for unpatched servers.

Once inside, attackers gain full control of the cPanel host: all managed websites, databases, email accounts, and server configurations. That makes it an ideal ransomware staging point — encrypt everything, hit every tenant on the shared host, demand payment from the hosting provider.

Who is affected

Every version of cPanel & WHM and WP Squared prior to the emergency patch is vulnerable. The patch was released as an out-of-cycle update; cPanel does not publish exact version numbers for security fixes, but running the forced update via the command line or the WHM auto-update interface will apply it. CISA added CVE-2026-41940 to its Known Exploited Vulnerabilities (KEV) catalog and ordered all Federal Civilian Executive Branch agencies to patch by today.

How to fix it

Run the cPanel update script with elevated privileges:

/scripts/upcp --force

If immediate patching is not possible, block cPanel’s web UI ports at the firewall: 2083 (cPanel), 2087 (WHM), 2095 (webmail), and 2096 (webmail SSL). This prevents external exploitation but does not address internal lateral movement if a tenant account is already compromised.

The bigger picture

cPanel powers a significant share of shared hosting globally, particularly among small and mid-market hosting providers. Vulnerabilities in the control panel layer are uniquely dangerous because a single compromised host multiplies the blast radius across every tenant. The “Sorry” ransomware campaign targeting this flaw is exactly the kind of supply-chain-amplified attack that makes hosting infrastructure disproportionately valuable as a ransomware target.

If you manage cPanel infrastructure or advise clients who do, treat this as P0. The PoC is public, the exploitation is automated, and 44,000 already-compromised servers prove the attackers are not waiting.