Description
cPanel & WHM 是 cPanel, LLC. 开发的 Web 主机控制面板解决方案，WHM 是服务器管理界面，cPanel 是用户面板，该产品管理着全球超过 7000 万个域名，是共享托管基础设施的核心组件。cPanel & WHM 在会话处理过程中存在权限绕过漏洞，未经身份验证的攻击者可通过 CRLF 注入操作会话文件，将预认证会话提升为 root 权限会话，从而获取服务器完整管理权限。
cPanel & WHM 权限绕过漏洞（CVE-2026-41940）
PoC
https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.References
https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/
https://support.cpanel.net/hc/en-us/articles/40073787579671-Security-CVE-2026-41940-cPanel-WHM-WP2-Security-Update-04-28-2026
https://nvd.nist.gov/vuln/detail/CVE-2026-41940
https://www.rapid7.com/blog/post/etr-cve-2026-41940-cpanel-whm-authentication-bypass/
https://www.cve.org/CVERecord?id=CVE-2026-41940
https://www.picussecurity.com/resource/blog/cve-2026-41940-explained-cpanel-whm-authentication-bypass-hit-1-5m-servers
https://success.trendmicro.com/en-US/solution/KA-0023294
https://www.vulncheck.com/advisories/cpanel-and-whm-authentication-bypass-via-login-flow
https://github.com/watchtowrlabs/watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py