Deep Dive into cPanel Auth Bypass CVE‑2026‑41940: CRLF Injection and the “Sorry” Ransomware Storm

1. Overview

On 2026‑04‑28, the watchTowr and Searchlight Cyber teams disclosed a critical authentication‑bypass vulnerability in WebPros cPanel & WHM (CVE‑2026‑41940) with a CVSS score of 9.8. The flaw allows an attacker to obtain full cPanel or WHM access without any credentials by injecting a CRLF sequence into the whostmgrsession cookie, which writes an arbitrary cp_auth=1 flag into the session file.

1.1 Background

cPanel is one of the most widely deployed web‑hosting control panels, serving thousands of sites per server. A successful pre‑authentication attack can therefore expose all hosted resources on the compromised server.

1.2 CVE Details

CVE ID: CVE‑2026‑41940

Vulnerability type: Authentication Bypass

CVSS v3 score: 9.8 (Critical)

Affected components: cPanel & WHM (user and admin interfaces), XML‑API, UAPI, WP Squared

Exposed ports: 2082/2083 (cPanel), 2086/2087 (WHM)

Prerequisites: No authentication, no user interaction, no special privileges

Status: Public PoC released on disclosure day; widely exploited in the wild.

2. Technical Root Cause

2.1 Session‑file CRLF injection

The vulnerability stems from the cPanel cpsrvd daemon’s session‑management logic, which performs three chained actions:

Write session file before authentication. The daemon creates a session file on disk prior to completing user authentication, introducing a timing flaw.

Cookie segment omission bypasses encryption. By omitting a specific segment of the whostmgrsession cookie, the daemon skips the normal encryption step for session data.

CRLF injection inserts authentication flag. An attacker injects a \r\n (CRLF) sequence into the controllable cookie value, causing the daemon to write arbitrary key‑value pairs—most critically cp_auth=1 —into the session file. Subsequent requests read this flag and treat the session as already authenticated.

The entire attack requires only a crafted HTTP request; no valid credentials are needed.

2.2 Affected interfaces

Beyond the web UI (ports 2082/2083) and WHM UI (2086/2087), the cPanel XML‑API and UAPI endpoints that rely on session authentication are also vulnerable, exposing automated management scripts to the same bypass.

3. Exploitation Chain

3.1 Public PoC

watchTowr Labs and Searchlight Cyber released a single‑file Python PoC on the day of disclosure. The script injects a CRLF sequence into the Authorization: Basic header, contaminating the session file with the authentication flag. Subsequent analysis by the Mallory platform confirmed the PoC’s operation.

The open‑source SessionScribe repository (GPL‑v2) on GitHub provides detection, mitigation, and response tools, including a ModSecurity rule set and host‑based IOC scanners.

3.2 Real‑world GitHub Actions abuse

In mid‑July 2026, researchers uncovered a large‑scale abuse of GitHub Actions. An attacker compromised the GitHub account of PHP developer dinushchathurya, injecting 583 malicious workflow files across ten PHP packages. Each workflow, when triggered on a GitHub‑hosted runner, downloads a Linux payload from C2 server 43.228.157.68, scans for exposed cPanel/WHM services, attempts CVE‑2026‑41940 exploitation, and, upon success, harvests credentials, configuration files, database dumps, SSH keys, API tokens, cloud keys, and payment‑service credentials, exfiltrating them back to the attacker.

Approximately 6,100 matching workflow files were identified, indicating a campaign far larger than a single compromised account.

3.3 “Sorry” ransomware linkage

Shadowserver Foundation tracking shows that the “Sorry” ransomware family actively uses CVE‑2026‑41940 in live intrusions. The ransomware, written in Go and statically linked for cross‑platform execution (Linux and China’s Xinchuang OS), encrypts files and appends a .sorry suffix before spreading laterally via weak SSH passwords.

The China National Computer Virus Emergency Response Center issued an urgent alert in early August 2026, explicitly linking the vulnerability to the “Sorry” ransomware chain.

4. Post‑exploitation Impact

Read and modify all files hosted on the compromised accounts.

Access and exfiltrate database contents.

Steal stored credentials (SSH keys, API tokens, etc.).

Deploy web shells or additional malware.

Escalate to WebHost Manager (root‑level) access.

Move laterally to other sites hosted on the same server.

Given cPanel’s dominant market share, the vulnerability poses a severe threat to hosting providers and their customers.

5. Fixes and Mitigations

5.1 Immediate patch

Applying the official patch is the only reliable fix. cPanel & WHM released security updates for all affected branches on 2026‑04‑28. Affected users should apply the patch within 24 hours. WP Squared users must also upgrade to the corresponding fixed version.

5.2 Temporary mitigations

Network‑level isolation. Restrict cPanel and WHM ports (2082/2083/2086/2087) to trusted IP ranges via firewall rules or cPanel’s Host Access Control. If remote management is unnecessary, block public access to the WHM interface entirely.

WAF rules. Enable Cloudflare Managed Ruleset; Cloudflare deployed an emergency rule for CVE‑2026‑41940 on 2026‑04‑30. Note that WAF rules are mitigations, not replacements for the patch.

Log monitoring. Scrutinize cPanel access logs for abnormal source IPs, unusually short authentication times, or geographic anomalies. cPHulk Brute Force Protection can help limit brute‑force attempts.

5.3 Post‑incident investigation

Audit creation and permission‑change records for all cPanel/WHM accounts.

Search for unknown SSH keys or API tokens.

Review crontab and scheduled tasks for persistent backdoors.

Examine file upload logs and timestamps for suspicious activity.

6. Conclusion

CVE‑2026‑41940 is among the most dangerous cPanel vulnerabilities discovered in recent years. Its pre‑authentication, non‑interactive nature and publicly available PoC make it an attractive weapon for cyber‑crime. The vulnerability has been weaponized at scale—from a distributed GitHub Actions scanning network to the “Sorry” ransomware chain. All organizations running cPanel & WHM 11.40 or later must treat this as an emergency: apply the patch immediately, employ network isolation if patching cannot be done instantly, and accelerate validation in test environments.