cPanel has released an official bash script specifically designed to help administrators identify if their servers were compromised via the **CVE-2026-41940** authentication bypass. This tool is essential for identifying artifacts left in the server’s filesystem. [cPanel Support](https://support.cpanel.net/hc/en-us/articles/40073787579671-Security-CVE-2026-41940-cPanel-WHM-WP2-Security-Update-04-28-2026) [GitHub](https://github.com/3tternp/CVE-2026-41940—cPanel-WHM-check)
The script, titled ‘ioc_checksessions_files.sh’, triages the ‘/var/cpanel/sessions/raw/’ directory for specific Indicators of Compromise (IOCs). It looks for injected plaintext session attributes like ‘user=root’ and ‘tfa_verified=1’ that are unique to this CRLF injection attack. [cPanel Support](https://support.cpanel.net/hc/en-us/articles/40073787579671-Security-CVE-2026-41940-cPanel-WHM-WP2-Security-Update-04-28-2026) [Cato Networks](https://www.catonetworks.com/blog/threat-brief:cve-2026-41940:critical-cpanel-whm-authentication-bypass-actively-exploited-in-the-wild)
The script categorizes findings by severity:
– **CRITICAL:** Confirmed exploitation artifacts. Treatment as a full compromise is required.
– **ATTEMPT:** Indicators of a failed exploit attempt.
– **WARNING/INFO:** General anomalies that require manual review. [cPanel Support](https://support.cpanel.net/hc/en-us/articles/40073787579671-Security-CVE-2026-41940-cPanel-WHM-WP2-Security-Update-04-28-2026)
If the script returns a critical finding, immediate response is necessary. This includes purging sessions, forcing password resets for root and WHM users, and auditing logs for unauthorized access or persistence mechanisms like hidden SSH keys or backdoors. [cPanel Support](https://support.cpanel.net/hc/en-us/articles/40073787579671-Security-CVE-2026-41940-cPanel-WHM-WP2-Security-Update-04-28-2026) [Beazley Security](https://beazley.security/alerts-advisories/critical-vulnerability-in-cpanel-and-whm-under-active-exploitation-cve-2026-41940)