Pentest-Tools.com Releases Free Scanner for CVE-2026-41940 as cPanel Authentication Bypass Enters Its Third Week of Active Exploitation

Pentest-Tools.com has released a free, no-login scanner for CVE-2026-41940 , the critical authentication bypass affecting cPanel & WHM and WP Squared that has been actively exploited in the wild since at least February 2026. The vulnerability, rated CVSS 9.8 Critical and added to CISA’s Known Exploited Vulnerabilities catalog , allows an unauthenticated attacker to bypass cPanel’s login process entirely by exploiting a CRLF injection flaw in cpsrvd, the cPanel service daemon.