Summary

Adds a new NSE script, http-vuln-cve2026-41940, to detect cPanel WebHost Manager (WHM) instances that appear vulnerable to CVE-2026-41940. The check follows the same multi-step verification sequence as the public proof-of-concept: canonical host resolution, unprivileged whostmgrsession acquisition, crafted HTTP Basic injection, cache propagation via a denied session probe, and confirmation using the JSON API version endpoint. The script registers in scripts/script.db with categories intrusive, vuln, and auth.

Motivation

Researchers and administrators need a standard, auditable way to run this verification from Nmap alongside other HTTP checks, without shipping a separate tool.

Behaviour

• Port rule: TCP 2086, 2087, and 2096 (typical WHM / related listener ports).
• Output: Uses vulns.Report (VULNERABLE when the chain succeeds; UNKNOWN when early steps fail, e.g. no WHM surface; NOT VULNERABLE when the final probe does not confirm).
• Safety scope: Stops at the documented verification (version API probe only); does not enumerate accounts or mutate server configuration beyond what the POC already does.

Script arguments

Example usage

nmap -p2087 --script http-vuln-cve2026-41940 <target>
nmap -p2086,2087,2096 -sV --script http-vuln-cve2026-41940 <target>