CVE-2026-41940

The vulnerability is caused by improper handling of session data within cPanel & WHM. Due to insufficient sanitisation during session creation and processing, an attacker can craft malicious requests that manipulate how session information is stored and interpreted by the system. By exploiting this flaw, an attacker can inject controlled data into session files and effectively alter authentication-related attributes. This allows the attacker to bypass the normal authentication flow and establish a session that is treated as fully authenticated, even without valid credentials. Once access is obtained, the attacker can operate with administrative privileges. This includes full control over the server, access to hosted websites and databases, and the ability to create persistence mechanisms such as backdoors or additional user accounts. Given the central role of cPanel in hosting environments, this can lead to large-scale compromise affecting multiple customers and services.

EPSS 97.93% · 99.9th percentile