cPanel Authentication Bypass Vulnerability Exploited in the Wild

A critical authentication-bypass vulnerability in cPanel has sparked a “cyber-frenzy,” according to Dark Reading. The flaw, which allows attackers to bypass authentication, saw multiple proof-of-concept exploits emerge almost immediately after disclosure. This rapid weaponization signals a high level of attacker interest and capability.

Dark Reading further reports that at least one researcher claims zero-day activity related to this vulnerability has been ongoing for at least a month prior to public disclosure. This extends the window of potential compromise significantly, meaning organizations running vulnerable cPanel instances could have been exposed for weeks without realizing it. Millions of cPanel installations are at risk, making this a widespread and urgent threat.

Attackers are leveraging this flaw to gain unauthorized access, which can lead to full system compromise, data exfiltration, or further lateral movement within a network. The ease of exploitation and the widespread deployment of cPanel make this a prime target for opportunistic threat actors, as well as more sophisticated groups looking for persistent access.