An exploit has been published for a critical vulnerability in cPanel

Researchers presented cve-2026-41940-PoC — a tool for exploiting a critical vulnerability in the cPanel hosting control panel. The vulnerability allows attackers to bypass authentication and gain superuser (root) privileges on the target system.

The attack mechanism is based on the use of CRLF-injection, which leads to a disruption of access rights verification logic. The tool automates the process of finding vulnerable nodes, allows downloading a list of accounts, and provides an interactive shell for executing commands with maximum privileges in the system.

The publication of the PoC code on GitHub gives server administrators the opportunity to check their systems for vulnerability to this threat. The use of the CVE-2026-41940 vulnerability does not require prior access to accounts, which makes it extremely dangerous for infrastructures using standard cPanel configurations without up-to-date security patches.

At the moment, server owners are recommended to conduct an audit of access logs and ensure the installation of the latest security updates from the control panel developers. The exploitation of similar vulnerabilities through header injections remains one of the most effective attack vectors on web interfaces for server management.