VulnerabilitySANS NewsBites
Patch Now: cPanel and WHM Critical Authentication Bypass
NEOSEC enrichment — no mirror of the original source
Web hosting control panel provider cPanel has disclosed and issued patches for a critical flaw affecting all currently supported versions of cPanel and its WebHost Manager (WHM) administrative interface application. CVE-2026-41940, CVSS sco
Source: SANS NewsBites. For licensing reasons NEOSEC Intel does not mirror the full text verbatim. The full text and expert commentary are available at the original source.
Read the issue at SANS NewsBitesLinked advisories
- CVE-2026-41940cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain una…
- CVE-2026-41940WebPros cPanel & WHM and WP2 (WordPress Squared) — WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability
Affected vendors and products
More on cPanel
Other advisories
- Not ratedosv:MGASA-2026-0559Updated perl-Cpanel-JSON-XS package fixes security vulnerabilities
- Not ratedosv:openSUSE-SU-2026:12217-1perl-Cpanel-JSON-XS-4.800.0-1.1 on GA media
- Not ratedCVE-2026-110688Cpanel-JSON-XS: ineffiziente algorithmische Komplexität
- Not ratedCVE-2026-110687Cpanel-JSON-XS: fehlerhafte Behandlung von Unicode-Kodierung
- Not ratedCVE-2026-110686Cpanel-JSON-XS: Use-After-Free
- Not ratedCVE-2026-110685Cpanel-JSON-XS: Speicherleck
- Not ratedosv:AZL-109860CVE-2026-110686 affecting package perl-Cpanel-JSON-XS 4.39-1
- Not ratedosv:AZL-109851CVE-2026-110685 affecting package perl-Cpanel-JSON-XS 4.39-1
Other news entries
- cPanel cPanel/WHM: Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
- cPanel cPanel/WHM: Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
- cPanel cPanel/WHM: Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
- New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server ControlNewsThe Hacker News
- Acronis cPanel Backup Plugin Vulnerability Exploited in Targeted AttacksNewsThe Hacker News
- Acronis Patches Exploited Vulnerability in cPanel Backup PluginNewsSecurityWeek
- Acronis warns of actively exploited flaw in its cPanel backup pluginNewsBleepingComputer
- LiteSpeed Enterprise Flaw Could Let One Hosting Account Gain Root Access on a Shared ServerNewsThe Hacker News
Source: https://support.cpanel.net/
ID