cPanel Authentication Bypass: Securing CVE-2026-41940 and Defeating ‘.sorry’ Ransomware

CLASSIFICATION: TLP:CLEAR

Security Intelligence Report (SIR-009)

SUBJECT: Resolving the cPanel Authentication Bypass Vulnerability (CVE-2026-41940)
DATE: June 11, 2026
STATUS: CRITICAL ACTION REQUIRED

INCIDENT CONTEXT: A critical zero-day vulnerability, tracked as CVE-2026-41940, is currently undergoing mass exploitation across the hosting industry. This flaw enables unauthenticated remote threat actors to execute a complete cPanel Authentication bypass, acquiring root administrative privileges on affected WHM/cPanel server nodes. Once access is obtained, attackers deploy the highly destructive .sorry ransomware to encrypt entire tenant home directories and databases. This guide provides the official cPanel Authentication bypass fixes, immediate firewall mitigations, and Indicators of Compromise (IOCs) to secure your infrastructure.

For DevOps engineers and Linux system administrators, immediate remediation is required. Because this vulnerability requires no user interaction and targets public-facing web interfaces, servers that are left unpatched are highly likely to face encryption. To defend your systems, you must understand the underlying technical mechanics and apply security configurations immediately.

Technical Mechanics: The cPanel Authentication Bypass

The core vulnerability resides within the session parser of cPanel’s internal HTTP server (cpsrvd). A CRLF (Carriage Return Line Feed) injection vulnerability allows attackers to manipulate HTTP requests to forge valid administrator session files. By injecting CRLF characters (%0D%0A or rn) into the authentication headers or session query parameters, attackers trick the session loader into treating arbitrary strings as authenticated session properties.

Normally, cPanel requires verification of credentials against system PAM or its internal database. However, the CRLF injection bypasses the PAM authentication stage by writing a mock session file directly into cPanel’s session directory (/var/cpanel/sessions/). The application reads this malformed file, believes it to be a pre-authenticated root session, and establishes a session cookie for the attacker. This renders Multi-Factor Authentication (MFA), cPHulk brute-force protection, and standard portal access controls entirely ineffective.

The ‘.sorry’ Ransomware Attack Chain

Automated botnets scan public ports 2083 (cPanel SSL) and 2087 (WHM SSL). Once an vulnerable node is identified, the exploit payload performs the following actions:

1. Authentication Bypass: Logs in as root via the forged session token.
2. Database Termination: Executes service teardowns on MySQL, MariaDB, and PostgreSQL (systemctl stop mariadb) to release file locks on database stores.
3. Evasion and Deletion: Deletes local and remote cPanel backup configurations, targeting directory paths like JetBackup (/usr/bin/jetbackup) and native cPanel backup directories.
4. Ransomware Execution: Drops and runs a statically-compiled Go binary that encrypts all files in /home/, appending the .sorry extension to each file.

Immediate Remediation: Apply the cPanel Authentication Bypass Fix

cPanel has released emergency security updates to mitigate CVE-2026-41940. If your server is running a version older than 11.136.0.5, you must upgrade immediately. Follow the steps below to force an update:

# 1. Access the server terminal via SSH as root
# 2. Run the cPanel update script to force download the latest secure build
/scripts/upcp --force

# 3. Restart the cPanel background daemon to flush active sessions
systemctl restart cpanel

# 4. Verify your cPanel version is 11.136.0.5 or newer
/usr/local/cpanel/cpanel -V

Emergency Mitigation: Firewall Port Isolation

If you cannot immediately update the system due to compatibility locks or licensing issues, you must isolate cPanel’s management ports behind a trusted VPN or IP whitelist. Block all public access to the control panel ports immediately:

# Allow access to WHM (2087) and cPanel (2083) ONLY from a secure administrative IP
ufw allow from 203.0.113.50 to any port 2087
ufw allow from 203.0.113.50 to any port 2083

# Deny all other public traffic to cPanel & WHM standard ports
ufw deny 2082/tcp
ufw deny 2083/tcp
ufw deny 2086/tcp
ufw deny 2087/tcp
ufw deny 2095/tcp
ufw deny 2096/tcp

# Reload firewall configurations
ufw reload

Detecting Active Compromise (IOCs)

If your server was exposed to the public internet without the patch, check for the following Indicators of Compromise (IOCs):

Frequently Asked Questions (FAQs)