CVE-2026-41940: cPanel & WHM - Authentication Bypass via Session-File CRLF Injection
HoneyLabs honeypots recorded 22 probes matching CVE-2026-41940 from 9 distinct source IP addresses in the last 7 days, of which 15 on interactive sensors. Severity is rated critical.
This CVE is on CISA's Known Exploited Vulnerabilities list. CISA added it on 2026-04-30.
5 sources probed for CVE-2026-41940 on the interactive sensors. None of them sent the exploit payload.
What the sensors show
Probes arrived on 6 of the 7 days in this window. The busiest day was 2026-11-10, with 9. One address, 217.60.76.167, sent 36% of them. The largest source network was AS401626 (Netiface America, Inc.), with 36% of the probes from 1 address. Over the last 90 days the sensors recorded 536 probes for it. The probing clients presented 6 distinct TLS fingerprints, most often t13i301000_1d37bd780c83_8e6e362c5eac.
Request paths that identify it
- /json-api/version
- /login/?login_only=1
Addresses probing it
| Source IP | Probes | Network | Country |
|---|---|---|---|
| 217.60.76.167 | 8 | Netiface America, Inc. | United Arab Emirates |
| 217.216.173.15 | 4 | 12651980 CANADA INC. | United States |
| 185.222.163.117 | 3 | Mizban Dadeh Roham Co | Iran |
| 185.193.67.26 | 2 | Contabo GmbH | France |
| 108.186.84.67 | 1 | 12651980 CANADA INC. | United States |
| 191.6.5.178 | 1 | Altatech Solucoes em Tecnologia EIRELI | Brazil |
| 43.128.232.190 | 1 | Tencent Building, Kejizhongyi Avenue | Japan |
| 45.148.10.171 | 1 | Techoff Srv Limited | The Netherlands |
Networks it comes from
| ASN | Organisation | Probes | Source IPs |
|---|---|---|---|
| AS401626 | Netiface America, Inc. | 8 | 1 |
| AS399486 | 12651980 CANADA INC. | 5 | 2 |
| AS197937 | Mizban Dadeh Roham Co | 3 | 1 |
| AS51167 | Contabo GmbH | 3 | 2 |
| AS132203 | Tencent Building, Kejizhongyi Avenue | 1 | 1 |
| AS271239 | Altatech Solucoes em Tecnologia EIRELI | 1 | 1 |
Where it comes from
| Country | Probes |
|---|---|
| United Arab Emirates | 8 |
| United States | 5 |
| France | 3 |
| Iran | 3 |
| Brazil | 1 |
| Japan | 1 |
Captured requests
- /login/?login_only=1
Requests the interactive sensors answered
- POST /login/?login_only=1
HTTP client fingerprints
- b11cuq070_00050817_9f8bde3d
- b11cuq168_80050817_e854f13d_x0e872ba97092abc4abebe808f7f6ff6…
- b11cuq060_00050813_95cc9d02
- b11cuq070_00050817_81cd6514
CVE report
Open a specific CVE from the CVE tracker.