Exploitation of cPanel Authentication Bypass CVE-2026-41940

In early May 2026, researchers identified active exploitation of CVE-2026-41940, a critical authentication bypass in cPanel & WHM, by an unknown threat actor. The actor leverages open-source proof-of-concept (PoC) code to forge session states, gaining root-level access to web management interfaces. This activity has been observed targeting military and government domains in the Philippines and Laos, as well as Managed Service Providers (MSPs) globally.

Technical analysis of the actor's infrastructure revealed a sophisticated post-exploitation toolkit including AdaptixC2, Ligolo-ng, and OpenVPN for internal pivoting. The actor also utilized a custom SQL injection exploit chain to compromise an Indonesian defense-sector portal and successfully exfiltrated approximately 4.37GB of sensitive documents related to China's state railway electrification infrastructure.

This campaign represents a significant regional threat, combining rapid adoption of N-day vulnerabilities with custom tooling for deep network penetration and bulk data theft. Organizations running cPanel or WHM must prioritize updating to patched versions (e.g., 11.136.0.5 or higher) immediately to mitigate the risk of full server compromise.