cPanel auth bypass exploited since February, now a KEV
Threat actors had a two-month head start before the emergency patch landed, CISA's KEV listing now makes remediation a compliance obligation, not just good hygiene.
TL;DR
CISA added CVE-2026-41940 (an unauthenticated authentication bypass in cPanel, WHM, and WP Squared that yields root-level remote code execution) to its Known Exploited Vulnerabilities catalog. KnownHost's CEO reports exploitation began as early as February 23, 2026; cPanel's emergency patch didn't arrive until April 28. Post-compromise activity includes the "Sorry" ransomware campaign, Mirai botnet installation, and espionage targeting Southeast Asian government and military entities. Shadowserver tracked 44,000 IPs scanning for and exploiting exposed instances. The exploit chain needs only a handful of HTTP requests and no valid credentials.
CISA added CVE-2026-41940 to the KEV catalog on April 30, 2026. The vulnerability is an authentication bypass in cPanel and WHM versions after 11.40, unauthenticated, no user interaction, and the full WHM API hands over root-level access through legitimate, exposed features once you're through the door. The CVSS 3.1 score from VulnCheck is 9.8. That's not inflated.
What makes this one different is the window. Daniel Pearson, CEO of KnownHost, told MS-ISAC that threat actors began exploiting the flaw on February 23, 2026. cPanel's emergency patch shipped April 28. That's roughly 64 days of active exploitation before a fix existed, not a zero-day in the marketing sense, but in the operational one: attackers had root on internet-facing servers for two months while defenders had nothing to apply.
What happened after the patch
Patching didn't stop the campaign, it compressed it. After public disclosure and watchTowr Labs' publication of a proof-of-concept exploit, activity surged. Shadowserver reported 44,000 IPs associated with scanning and exploitation at the time of the MS-ISAC advisory. Post-compromise payloads include a Go-based Linux encryptor tied to the "Sorry" ransomware campaign, Mirai botnet installation, credential harvesting, and cyber espionage operations targeting government and military entities in Southeast Asia.
Why the KEV listing matters for contractors
Binding Operational Directive 22-01 requires FCEB agencies to remediate KEV-listed vulnerabilities by a specified due date. The directive doesn't directly bind contractors, but the practical effect is similar: agencies will ask whether your systems are patched, and a "no" doesn't get a pass because BOD 22-01's formal scope stops at the agency boundary. If you're running internet-facing cPanel or WHM and haven't applied the April 28 patches, the two-month exploitation window means you can't lean on "we didn't see anything in the logs." Assume compromise and start triage.
Affected versions and remediation
Five version families are patched: 11.86.0.41, 11.110.0.97, 11.118.0.63, 11.126.0.54, and 11.130.0.19, plus 11.132.0.29, 11.134.0.20, and 11.136.0.5 for newer branches. WP Squared requires version 136.1.7. Apply them directly; there's no workaround that substitutes for the patch.
Published ·Deep Fathom