CriticalCVE-2026-41940

    WebPros cPanel and WHM Authentication Bypass via Login Flow (CVE-2026-41940)

    Published Last modified In CISA KEV since Sources: NCSC NZ, pwn.watch, EUVD, SingCERT, CVE.org

    What is affected, what to do

    cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

    The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. Update WebPros cPanel to version 11.86.0.41, WebPros cPanel to version 11.94.0.28, WebPros cPanel to version 11.102.0.39. Immediate actions, mitigation and detection rules are in the runbook below.

    Affected
    • WebPros cPanel lt 11.40.0.0..11.86.0.41
    • WebPros cPanel lt 11.88.0.0..11.94.0.28
    • WebPros cPanel lt 11.96.0.0..11.102.0.39
    • WebPros cPanel lt 11.104.0.0..11.110.0.97
    • WebPros cPanel lt 11.112.0.0..11.118.0.63
    • WebPros cPanel lt 11.120.0.0..11.124.0.35
    • WebPros cPanel lt 11.126.0.0..11.126.0.54
    • WebPros cPanel lt 11.128.0.0..11.130.0.19
    • WebPros cPanel lt 11.132.0.0..11.132.0.29
    • WebPros cPanel lt 11.134.0.0..11.134.0.20
    • WebPros cPanel lt 11.136.0.0..11.136.0.5
    • WebPros WP Squared lt *..11.136.1.7
    • WebPros WHM lt 11.40.0.0..11.86.0.41
    • WebPros WHM lt 11.88.0.0..11.94.0.28
    • WebPros WHM lt 11.96.0.0..11.102.0.39
    • WebPros WHM lt 11.104.0.0..11.110.0.97
    • WebPros WHM lt 11.112.0.0..11.118.0.63
    • WebPros WHM lt 11.120.0.0..11.124.0.35
    • WebPros WHM lt 11.126.0.0..11.126.0.54
    • WebPros WHM lt 11.128.0.0..11.130.0.19
    • WebPros WHM lt 11.132.0.0..11.132.0.29
    • WebPros WHM lt 11.134.0.0..11.134.0.20
    • WebPros WHM lt 11.136.0.0..11.136.0.5
    Fixed in
    • WebPros cPanel 11.86.0.41
    • WebPros cPanel 11.94.0.28
    • WebPros cPanel 11.102.0.39
    • WebPros cPanel 11.110.0.97
    • WebPros cPanel 11.118.0.63
    • WebPros cPanel 11.124.0.35
    • WebPros cPanel 11.126.0.54
    • WebPros cPanel 11.130.0.19
    • WebPros cPanel 11.132.0.29
    • WebPros cPanel 11.134.0.20
    • WebPros cPanel 11.136.0.5
    • WebPros WP Squared 11.136.1.7
    • WebPros WHM 11.86.0.41
    • WebPros WHM 11.94.0.28
    • WebPros WHM 11.102.0.39
    • WebPros WHM 11.110.0.97
    • WebPros WHM 11.118.0.63
    • WebPros WHM 11.124.0.35
    • WebPros WHM 11.126.0.54
    • WebPros WHM 11.130.0.19
    • WebPros WHM 11.132.0.29
    • WebPros WHM 11.134.0.20
    • WebPros WHM 11.136.0.5

    Not sure whether and how you are affected? Ask a question about this vulnerability

    Metrics

    9.8

    Priority

    XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.

    Source: NVD, CVSS v3

    9.8

    CVSS v3

    Severity Critical on the scale from 0 to 10.

    Source: NCSC NZ, pwn.watch, EUVD, SingCERT, CVE.org

    98.5 %

    EPSS score

    High — model estimates ≥ 50% chance of real-world exploitation within 30 days.

    Source: FIRST EPSS, percentile 99.92

    Show all metrics
    Severity
    Critical
    Priority (0–325)

    The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?

    Read in glossary
    270.77 Methodology
    Exploit maturity

    An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack.

    Read in glossary
    actively exploitedSource: VulnCheck KEV (opens in a new tab), NCSC NZ, CSA/SingCERT How we classify
    XIEM Effective CVSS

    XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command.

    Read in glossary
    9.8 Methodology
    CVSS v3

    CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions.

    Read in glossary
    9.8
    CVSS v4

    CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions.

    Read in glossary
    9.3
    EPSS score

    The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“.

    Read in glossary
    98.5 %
    High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
    EPSS percentile

    The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking.

    Read in glossary
    99.92
    Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
    KEV status

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    Actively exploited
    Published
    In CISA KEV since

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    CWE

    CWE is a catalogue of typical weakness types in software and hardware — such as flawed input validation, unsafe memory handling or poor authentication. Where a CVE names a concrete vulnerability in a concrete product, a CWE describes the underlying class of defect.

    Read in glossary
    CWE-306

    Response and mitigation

    Why act now?

    Prioritisation rationale

    This is a pre-authentication, network-reachable bypass of the login flow. It spans virtually every cPanel release for more than a decade and gives direct control of the panel. With WHM access, that effectively means root on the whole host, including every hosted customer site, mailbox and database. It sits among the CVEs most likely to be exploited, and CISA confirms its use in ransomware campaigns. Typical targets are hosting providers, web agencies and organisations running their own shared-hosting boxes, which usually expose panel ports to the internet. Treat any internet-reachable unpatched instance as a top-priority emergency and assume compromise until the logs prove otherwise. NIS2 entities should assess their reporting obligation (24 h early warning) if indicators of compromise are found.

    1. Runbook step 1

      Immediate response (0-24 h)

      • Inventory and version check: Identify every cPanel & WHM and WP2 instance, including reseller, hosting and agency-managed servers. Check the version with /usr/local/cpanel/cpanel -V. Vulnerable builds are 11.40 through 86.0.41, 88.0.0–110.0.97, 112.0.0–118.0.63, 120.0.0–124.0.35, 126.0.1–126.0.54, 128.0.0–130.0.19, 132.0.0–132.0.29 and 134.0.0–134.0.20.
      • Patch now: Run /scripts/upcp --force to move to a build above the affected range for your tier. Look up the exact fixed build per release tier in the WebPros vendor advisory. Tiers with no fix, such as EOL builds below 88, must be migrated to a supported tier. Update WP2 per the vendor advisory.
      • Cut exposure until patched: Restrict ports 2082/2083 (cPanel), 2086/2087 (WHM) and 2095/2096 (Webmail) to admin jump hosts or VPN ranges, using the perimeter firewall or csf/iptables. Temporarily disable proxy subdomains such as cpanel., whm. and webmail..
      • Rotate credentials: After patching, rotate the root, WHM reseller and cPanel account passwords. Revoke and reissue all WHM and cPanel API tokens, and kill active sessions under /var/cpanel/sessions/.
      • Check for compromise: Preserve /usr/local/cpanel/logs/access_log, login_log and session_log covering at least 30 days before the KEV listing, before log rotation overwrites them. Then hunt for unknown accounts, resellers, SSH keys and cron jobs.

    2. Runbook step 2

      Mitigation layers

      • Network segmentation: Management ports (2083/2087) should never be internet-facing by default. Where customers need panel access, put it behind a reverse proxy with pre-authentication (SSO/mTLS). Allow WHM only from the admin network.
      • WHM configuration: Use Host Access Control (/etc/hosts.allow) to allowlist source IPs for whostmgrd and cpaneld. Enable cPHulk and enforce two-factor authentication for root and resellers. Treat 2FA as defence in depth only; it is not confirmed to block the bypass.
      • WAF/IPS: Flag requests to /login/, /json-api/ and /execute/ on the cPanel ports that end up with a valid cpsess session without a prior successful login. Inspect the login flow for unusual header or cookie manipulation. Deploy vendor signatures in Suricata, ModSecurity or Imunify360 as soon as they ship.
      • Least privilege: Minimise use of root API tokens and issue tokens with scoped ACLs and IP allowlists. Strip the all ACL from resellers that do not need it.
      • Recoverability: Given the confirmed ransomware use, verify offline or immutable backups of account data (/home, databases) held off the cPanel host. Treat any backup target the server can write to as at risk.

    3. Runbook step 3

      Detection rules

      • cPanel logs: Look for session_log NEW entries for root or resellers with no preceding successful login_log entry from the same source IP. This indicates a session created without a normal login. Also flag root WHM access from unfamiliar ASNs. SPL: index=cpanel source=*session_log* "NEW" user=root | search NOT src_ip IN (admin_ips)
      • Web access patterns: Hunt access_log for requests from external IPs to /json-api/createacct, /json-api/passwd, /json-api/api_token_create, /scripts*/ and /execute/. Pay particular attention to those shortly after /login/ requests that returned a non-200 status.
      • Persistence artefacts: Use auditd watches to catch new API tokens, SSH keys and accounts: -w /var/cpanel/authn/api_tokens_v2/ -p wa, -w /root/.ssh/authorized_keys -p wa, -w /var/cpanel/users/ -p wa. Also monitor for new entries in /var/spool/cron/.
      • Process ancestry (EDR): cpsrvd or whostmgr* should not spawn shells. Children such as bash, sh, curl, wget, python, perl -e or base64 are suspicious. Sigma shape: ParentImage|contains: 'cpsrvd' AND Image|endswith: ['/bash','/curl','/wget'].
      • Network (Zeek/Suricata): Watch for inbound TLS sessions on 2087/2083 from never-before-seen sources. Also watch for outbound connections from the host to paste or file-hosting services. A sudden spike in egress volume can indicate staging or exfiltration ahead of encryption.

    Detection rules

    No NEOSEC detection rule is available for this vulnerability yet.

    Classification under NIS2 and CRA

    Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

    NIS2

    NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

    Read in glossary
    Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).
    CRA

    The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

    Read in glossary
    Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.
    ISO/IEC 27001

    ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

    Read in glossary
    Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

    Description

    cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

    Source: NCSC NZ (CC BY 4.0), pwn.watch, ENISA EUVD, CSA/SingCERT, NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

    Affected products

    The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

    Affected products
    Affected versionsFixed in
    WebProscPanel
    • 11.112.0.0 – < 11.118.0.63
    • 11.134.0.0 – < 11.134.0.20
    • 11.136.0.0 – < 11.136.0.5
    • 11.88.0.0 – < 11.94.0.28
    • 11.104.0.0 – < 11.110.0.97
    • 11.120.0.0 – < 11.124.0.35
    • 11.132.0.0 – < 11.132.0.29
    • 11.96.0.0 – < 11.102.0.39
    • 11.128.0.0 – < 11.130.0.19
    • 11.40.0.0 – < 11.86.0.41
    • 11.126.0.0 – < 11.126.0.54
    • 11.118.0.63
    • 11.134.0.20
    • 11.136.0.5
    • 11.94.0.28
    • 11.110.0.97
    • 11.124.0.35
    • 11.132.0.29
    • 11.102.0.39
    • 11.130.0.19
    • 11.86.0.41
    • 11.126.0.54
    WebProsWHM
    • 11.128.0.0 – < 11.130.0.19
    • 11.132.0.0 – < 11.132.0.29
    • 11.134.0.0 – < 11.134.0.20
    • 11.136.0.0 – < 11.136.0.5
    • 11.40.0.0 – < 11.86.0.41
    • 11.120.0.0 – < 11.124.0.35
    • 11.104.0.0 – < 11.110.0.97
    • 11.112.0.0 – < 11.118.0.63
    • 11.88.0.0 – < 11.94.0.28
    • 11.126.0.0 – < 11.126.0.54
    • 11.96.0.0 – < 11.102.0.39
    • 11.130.0.19
    • 11.132.0.29
    • 11.134.0.20
    • 11.136.0.5
    • 11.86.0.41
    • 11.124.0.35
    • 11.110.0.97
    • 11.118.0.63
    • 11.94.0.28
    • 11.126.0.54
    • 11.102.0.39
    WebProsWP Squared
    • < 11.136.1.7
    • 11.136.1.7
    cpanelcpanel
    • 120.0.0 – < 124.0.35
    • 11.40 – < 86.0.41
    • 128.0.0 – < 130.0.19
    • 134.0.0 – < 134.0.20
    • 112.0.0 – < 118.0.63
    • 88.0.0 – < 110.0.97
    • 126.0.1 – < 126.0.54
    • 132.0.0 – < 132.0.29
    • 136.0.0 – < 136.0.5
    • 124.0.35
    • 86.0.41
    • 130.0.19
    • 134.0.20
    • 118.0.63
    • 110.0.97
    • 126.0.54
    • 132.0.29
    • 136.0.5
    cpanelwhm
    • 132.0.0 – < 132.0.29
    • 128.0.0 – < 130.0.19
    • 112.0.0 – < 118.0.63
    • 120.0.0 – < 124.0.35
    • 88.0.0 – < 110.0.97
    • 134.0.0 – < 134.0.20
    • 11.40 – < 86.0.41
    • 136.0.0 – < 136.0.5
    • 126.0.1 – < 126.0.54
    • 132.0.29
    • 130.0.19
    • 118.0.63
    • 124.0.35
    • 110.0.97
    • 134.0.20
    • 86.0.41
    • 136.0.5
    • 126.0.54
    cpanelwp_squared
    • < 136.1.7
    • 136.1.7

    Vendors and products

    Weakness classes (CWE)

    • CWE-306Missing Authentication for Critical Function

      Base

      The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

      Entry at MITRE CWE-306

    Public exploit references

    Publicly reported proof-of-concepts, exploit modules and detection templates for this vulnerability. NEOSEC links to the original sources only and does not provide any exploit code.

    Public exploit references
    CISA KEV CatalogCISA Known Exploited Vulnerability (opens in a new tab)cisa.govactively exploited
    CSA/SingCERTActive Exploitation of Critical Vulnerability in cPanel, WebHost Manager (WHM) and WordPress Squared (WP2) (opens in a new tab)CSA/SingCERTactively exploited
    NCSC NZAuthentication bypass vulnerability in cPanel and WHM (opens in a new tab)NCSC NZactively exploited
    Reference tagged as exploitlabs.watchtowr.com (opens in a new tab)PoC (publicly reported)reported, not verified—
    Reference tagged as exploitgithub.com (opens in a new tab)PoC (publicly reported)reported, not verified—
    PoC-in-GitHub (nomi-sec)CVE-2026-41940-PoC (opens in a new tab)github.comPoC (publicly reported)reported, not verified
    PoC-in-GitHub (nomi-sec)cve-2026-41940-PoC (opens in a new tab)github.comPoC (publicly reported)reported, not verified
    PoC-in-GitHub (nomi-sec)cve-2026-41940-PoC (opens in a new tab)github.comPoC (publicly reported)reported, not verified
    PoC-in-GitHub (nomi-sec)cve-2026-41940-PoC (opens in a new tab)github.comPoC (publicly reported)reported, not verified
    PoC-in-GitHub (nomi-sec)cve-2026-41940-PoC-Linux (opens in a new tab)github.comPoC (publicly reported)reported, not verified
    PoC-in-GitHub (nomi-sec)CVE-2026-41940 (opens in a new tab)github.comPoC (publicly reported)reported, not verified
    PoC-in-GitHub (nomi-sec)CVE-2026-41940 (opens in a new tab)github.comPoC (publicly reported)reported, not verified
    PoC-in-GitHub (nomi-sec)cve-2026-41940-PoC (opens in a new tab)github.comPoC (publicly reported)reported, not verified
    PoC-in-GitHub (nomi-sec)cve-2026-41940-PoC (opens in a new tab)github.comPoC (publicly reported)reported, not verified
    PoC-in-GitHub (nomi-sec)CVE-2026-41940-Security-Patch (opens in a new tab)github.comPoC (publicly reported)reported, not verified
    PoC-in-GitHub (nomi-sec)cPanel-WHM-CVE-2026-41940-auth-bypass-exploit (opens in a new tab)github.comPoC (publicly reported)reported, not verified
    PoC-in-GitHub (nomi-sec)CVE-2026-41940 (opens in a new tab)github.comPoC (publicly reported)reported, not verified
    PoC-in-GitHub (nomi-sec)Cpanel (opens in a new tab)github.comPoC (publicly reported)reported, not verified
    PoC-in-GitHub (nomi-sec)cve-2026-41940-cpanel_authbypass_reproduction (opens in a new tab)github.comPoC (publicly reported)reported, not verified
    PoC-in-GitHub (nomi-sec)cve-2026-41940-PoC (opens in a new tab)github.comPoC (publicly reported)reported, not verified
    PoC-in-GitHub (nomi-sec)CVE-2026-41940-analysis (opens in a new tab)github.comPoC (publicly reported)reported, not verified
    PoC-in-GitHub (nomi-sec)CVE-2026-41940-PoC (opens in a new tab)github.comPoC (publicly reported)reported, not verified
    PoC-in-GitHub (nomi-sec)CVE-2026-41940-PoC (opens in a new tab)github.comPoC (publicly reported)reported, not verified
    PoC-in-GitHub (nomi-sec)cpanel-cve-41940-detector (opens in a new tab)github.comPoC (publicly reported)reported, not verified
    PoC-in-GitHub (nomi-sec)CVE-2026-41940 (opens in a new tab)github.comPoC (publicly reported)reported, not verified

    References & sources

    • support.cpanel.netWebPros cPanel & WHM and WP2 (WordPress Squared) — CVE-2026-41940euvd, Vendor advisory, Patch, pwn-watch, Vendor advisory
    • docs.cpanel.netrelease-notes/release-noteseuvd, Release notes, Release notes
    • docs.wpsquared.comchangelogs/versions/changelogeuvd, Release notes, Release notes
    • namecheap.comstatus-updates/ongoing-critical-security-vulnerability-in-cpane…euvd, Third-party advisory, Third-party advisory
    • vulncheck.comadvisories/cpanel-and-whm-authentication-bypass-via-login-floweuvd, Third-party advisory, Third-party advisory
    • github.comwatchtowrlabs/watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.pyExploit, Exploit, Third-party advisory
    • cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41940government-resource, US government resource
    • bleepingcomputer.comnews/security/critrical-cpanel-flaw-mass-exploited-in-sorry-ran…Press coverage
    • labs.watchtowr.comthe-internet-is-falling-down-falling-down-falling-down-cpanel-w…Exploit, Third-party advisory
    • pwn.watchpwn.watch: WebPros cPanel & WHM and WP2 (WordPress Squared): WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerabilitypwn-watch
    • NVD (NIST)NVD: CVE-2026-41940pwn-watch
    • cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch

    Changes to this CVE

    Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

    1. Record modifiedVulnCheck

      Show 16 original changes
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      Affected versions (publisher)added
      —
      Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/41xxx/CVE-2026-41940.json">CVE-2026-41940</a>
      Referenceadded
      —
      https://docs.cpanel.net/release-notes/release-notes
      Referenceadded
      —
      https://docs.wpsquared.com/changelogs/versions/changelog/#13617
      Referenceadded
      —
      https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026
      Referenceadded
      —
      https://www.namecheap.com/status-updates/ongoing-critical-security-vulnerability-in-cpanel-april-28-2026
      Referenceadded
      —
      https://www.vulncheck.com/advisories/cpanel-and-whm-authentication-bypass-via-login-flow
      Referenceremoved
      https://docs.cpanel.net/release-notes/release-notes
      —
      Referenceremoved
      https://docs.wpsquared.com/changelogs/versions/changelog/#13617
      —
      Referenceremoved
      https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026
      —
      Referenceremoved
      https://www.namecheap.com/status-updates/ongoing-critical-security-vulnerability-in-cpanel-april-28-2026
      —
      Referenceremoved
      https://www.vulncheck.com/advisories/cpanel-and-whm-authentication-bypass-via-login-flow
      —
      Reference typeremoved
      https://docs.cpanel.net/release-notes/release-notes Types: Release Notes
      —
      Reference typeremoved
      https://docs.wpsquared.com/changelogs/versions/changelog/#13617 Types: Release Notes
      —
      Reference typeremoved
      https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026 Types: Vendor Advisory
      —
      Reference typeremoved
      https://www.namecheap.com/status-updates/ongoing-critical-security-vulnerability-in-cpanel-april-28-2026 Types: Third Party Advisory
      —
      Reference typeremoved
      https://www.vulncheck.com/advisories/cpanel-and-whm-authentication-bypass-via-login-flow Types: Third Party Advisory
      —

      Source identifier: disclosure@vulncheck.com

    2. Record modifiedCISA ADP

      Show 6 original changes
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      Referenceadded
      —
      https://github.com/watchtowrlabs/watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py
      Referenceadded
      —
      https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41940
      Referenceremoved
      https://github.com/watchtowrlabs/watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py
      —
      Referenceremoved
      https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41940
      —
      Reference typeremoved
      https://github.com/watchtowrlabs/watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py Types: Exploit, Third Party Advisory
      —
      Reference typeremoved
      https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41940 Types: US Government Resource
      —

      Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    3. Record modifiedCVE Program

      Show 6 original changes
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      Referenceadded
      —
      https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/
      Referenceadded
      —
      https://www.bleepingcomputer.com/news/security/critrical-cpanel-flaw-mass-exploited-in-sorry-ransomware-attacks/
      Referenceremoved
      https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/
      —
      Referenceremoved
      https://www.bleepingcomputer.com/news/security/critrical-cpanel-flaw-mass-exploited-in-sorry-ransomware-attacks/
      —
      Reference typeremoved
      https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/ Types: Exploit, Third Party Advisory
      —
      Reference typeremoved
      https://www.bleepingcomputer.com/news/security/critrical-cpanel-flaw-mass-exploited-in-sorry-ransomware-attacks/ Types: Press/Media Coverage
      —

      Source identifier: af854a3a-2127-422b-91ae-364da2661108

    One NVD translation into another language is hidden.

    Linked advisories

    Embed badge

    Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.

    Badge preview for CVE-2026-41940
    <a href="https://intel.neosec.eu/en/cve/CVE-2026-41940"><img src="https://intel.neosec.eu/badge/cve/CVE-2026-41940.svg?lang=en" alt="CVE-2026-41940 – NEOSEC Intel" height="20"></a>