The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog — a critical authentication bypass in cPanel & WHM and a high-severity local privilege escalation flaw in the Linux Kernel. Both are confirmed to be exploited in the wild, carrying immediate remediation obligations for Federal Civilian Executive Branch agencies and serving as a strong signal for the broader security community to act without delay.
CVE-2026-41940 — WebPros cPanel & WHM Authentication Bypass
CVSS Score: 9.8 (Critical)
CWE: CWE-306 — Missing Authentication for Critical Function
KEV Date Added: April 30, 2026
Federal Remediation Deadline: May 21, 2026
Affected Products: cPanel & WHM (all versions after 11.40), WP Squared (WordPress Squared)
Overview
CVE-2026-41940 is a pre-authentication remote authentication bypass in cPanel, WebHost Manager (WHM), and WP Squared. An unauthenticated attacker with network access to cPanel or WHM login pages — typically TCP ports 2083 or 2087 — can promote themselves into a privileged session and gain full root-level control of the server. Once in, they have access to every website, database, mailbox, and DNS zone the panel manages.
Technical Breakdown
The flaw chains a CRLF injection in the session writer with an encryption-skip triggered by a malformed cookie, then leverages a quirk in how cPanel caches sessions to “promote” the injected entry into a privileged login. Specifically, before authentication occurs, cpsrvd — the cPanel service daemon — writes a new session file to disk. The missing authentication stems from an improperly handled session loading and saving sequence.
Three security layers all failed simultaneously: the Basic-auth path that processes HTTP headers directly did not call the sanitizer that all other paths used, a malformed cookie bypasses the per-session encryption key check, and the session cache promotion logic does the rest.
Exploitation Timeline
Exploitation was observed since approximately February 23, 2026, per managed hosting provider KnownHost — meaning this was a true zero-day for roughly two months before cPanel’s emergency patch on April 28. Whether the researcher who reported the bug to cPanel knew about in-the-wild exploitation is unclear. It is also unclear why WebPros did not communicate the existence of such a critical vulnerability to hosting providers sooner and provide mitigation steps while working on a fix.
Scale of Exposure
Security firm watchTowr estimates cPanel is deployed on infrastructure serving roughly 70 million domains. The Shadowserver Foundation observed approximately 44,000 unique IPs scanning, exploiting, or brute-forcing against its honeypot sensors. The patch is now public, the technical writeup is public, and weaponized exploit code is circulating.
Observed Threat Activity
A notable campaign tracked by researchers leverages compromised cPanel instances to implant a JavaScript miner into thousands of low-traffic websites, turning visitors’ browsers into unwitting cryptocurrency miners. Another cluster uses the WHM API to register subdomains serving as command-and-control fallback relays for point-of-sale malware.
Remediation
Patched versions: 11.86.0.41, 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.130.0.1, and 11.136.0.5 for cPanel & WHM; 136.1.7 for WP Squared.
Mitigations include blocking inbound traffic on ports 2083, 2087, 2095, and 2096 at the firewall level. Run cPanel’s published IOC detection script to check session files for signs of exploitation. Review WHM account lists for unauthorized accounts, SSH keys, and FTP accounts created post-February 23, 2026.
CVE-2026-31431 — Linux Kernel “Copy Fail” Local Privilege Escalation
CVSS Score: 7.8 (High)
CWE: CWE-699 — Incorrect Resource Transfer Between Spheres
Alias: Copy Fail (tracked by Theori and Xint)
KEV Date Added: May 1, 2026
Federal Remediation Deadline: May 15, 2026
Affected Products: Linux Kernel (all versions prior to 6.18.22, 6.19.12, and 7.0)
Overview
CVE-2026-31431, dubbed “Copy Fail,” is a flaw in the algif_aead module of the Linux kernel’s AF_ALG cryptographic subsystem — specifically a logic bug in the authentication cryptographic template that causes improper memory handling during in-place operations. A 732-byte Python script is all an unprivileged local user needs to reliably escalate privileges to root.
Technical Breakdown
The bug combines AF_ALG and splice() to write 4 bytes into the page cache of any readable file. A 732-byte script can modify a setuid binary in memory without changing the file on disk, making detection difficult. The issue affects major distributions including Ubuntu, RHEL, SUSE, and Amazon Linux, and can even cross container boundaries due to the shared page cache.
Container Risk
Kaspersky stated that Docker, LXC, and Kubernetes grant processes inside a container access to the AF_ALG subsystem if the algif_aead module is loaded into the host kernel by default. Copy Fail poses a risk of breaching container isolation and gaining control over the physical machine. Exploitation does not require the use of complex techniques such as race conditions or memory address guessing, which lowers the entry barrier for potential attackers.
Detection Difficulty
Detecting the attack is difficult because the exploit uses only legitimate system calls, which are hard to distinguish from normal application behavior. Go and Rust versions of the original Python PoC implementation have already appeared in open-source repositories, broadening access to weaponized code.
Exploit Chain
An attacker with any low-privilege foothold — a normal user session on a Linux host or a compromised container process — runs the exploit. The 4-byte overwrite corrupts kernel-managed data in the page cache, the process is escalated to UID 0, and the attacker has full root privileges. No race conditions, no ASLR guessing, no special capabilities required.
Remediation
Patches are available in Linux kernel versions 6.18.22, 6.19.12, and 7.0. Organizations running Red Hat Enterprise Linux can apply configuration-level mitigations while patches are deployed. Where patching cannot be immediate, disable the AF_ALG subsystem, apply network isolation, and enforce access controls to limit low-privilege user sessions on sensitive hosts. Prioritize multi-tenant Linux hosts, CI/CD runners, Kubernetes nodes, and any environment where untrusted code runs alongside sensitive workloads.
Analyst Note
Both additions in this KEV batch target infrastructure control planes. CVE-2026-41940 hits the hosting management plane; CVE-2026-31431 hits the OS kernel. Neither is a theoretical risk — both carry confirmed in-the-wild exploitation confirmed before patches were available. The practical lesson is the same in both cases: management interfaces and kernel components are increasingly the primary target, not the secondary one. Patch velocity on these two must be treated as a business continuity function, not a routine patching cycle.
