Critical cPanel authentication bypass exploited for ransomware and server takeovers

A critical cPanel vulnerability tracked as CVE-2026-41940 is being actively abused to take over servers, deploy ransomware, and gain root-level access to hosting environments, according to Help Net Security and security researchers following the attacks. The flaw carries a CVSS score of 9.8, which puts it in the highest severity range and reflects the fact that an attacker does not need valid credentials to get in.

cPanel is one of the most widely used control panels for Linux hosting. It is commonly paired with WHM, short for WebHost Manager, which administrators use to manage server accounts, services, and security settings. If an attacker can bypass authentication in this layer, they are not just getting into a website admin panel, they can often control the underlying server itself.

The reported issue is especially serious because it defeats both passwords and two-factor authentication, the extra login step many administrators rely on for protection. That means the normal front door is not just unlocked, it is being bypassed entirely. Once inside, an attacker can create or modify accounts, alter hosted sites, install malicious payloads, and in some cases lock operators out of their own machines.

According to the reporting, the campaign has been active since February, which suggests the bug has been in live use for months rather than days. That kind of delay between first abuse and public recognition is common in hosting incidents, especially when the affected software sits behind provider-managed infrastructure and many customers do not directly control patching.

The scale is also notable. Help Net Security cited Shodan, a search engine that indexes internet-exposed devices and services, showing about 1.5 million exposed cPanel instances. Not every exposed server is necessarily vulnerable, but that number gives a sense of how much infrastructure could be at risk if patching lags behind exploitation.

Threat actors are reportedly using the access for multiple purposes. Some are taking over servers for persistence or web compromise, while others are deploying ransomware that appends a .sorry extension to files. A ransom note or file extension alone does not tell the whole story, but it is a clear sign that the incident response challenge has moved beyond simple intrusion and into data and service recovery.

The fact that the attacks are coming from multiple threat actors matters as well. When a vulnerability is adopted by different groups, it tends to spread quickly across the criminal ecosystem, with opportunistic scanning, automated exploitation, and follow-on abuse all happening at once. In practice, that means defenders are not dealing with a single campaign, but a busy market of attackers looking for any exposed cPanel target.

For hosting providers, the operational problem is straightforward and ugly. cPanel and WHM sit at the center of account management, so a bypass there can affect many customers on the same machine. That is one reason hosting software vulnerabilities often produce outsized damage, even when the underlying flaw is limited to a single product.

Help Net Security’s report frames CVE-2026-41940 as an issue with immediate real-world consequences, not a theoretical bug waiting for proof of concept. With exploitation already underway and exposed instances still numerous, the main story is not discovery but the speed at which attackers have turned a control-panel flaw into broad server access and ransomware deployment.