CVE-2026-41940

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Oct 26, 2026

Description

cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
WebPros	cPanel	>= 11.40.0.0, < 11.86.0.41; >= 11.88.0.0, < 11.94.0.28; >= 11.96.0.0, < 11.102.0.39; >= 11.104.0.0, < 11.110.0.97; >= 11.112.0.0, < 11.118.0.63; >= 11.120.0.0, < 11.124.0.35; >= 11.126.0.0, < 11.126.0.54; >= 11.128.0.0, < 11.130.0.19; >= 11.132.0.0, < 11.132.0.29; >= 11.134.0.0, < 11.134.0.20; >= 11.136.0.0, < 11.136.0.5
WebPros	WP Squared	< 11.136.1.7
WebPros	WHM	>= 11.40.0.0, < 11.86.0.41; >= 11.88.0.0, < 11.94.0.28; >= 11.96.0.0, < 11.102.0.39; >= 11.104.0.0, < 11.110.0.97; >= 11.112.0.0, < 11.118.0.63; >= 11.120.0.0, < 11.124.0.35; >= 11.126.0.0, < 11.126.0.54; >= 11.128.0.0, < 11.130.0.19; >= 11.132.0.0, < 11.132.0.29; >= 11.134.0.0, < 11.134.0.20; >= 11.136.0.0, < 11.136.0.5

References

https://docs.cpanel.net/release-notes/release-notesRelease Notes
https://docs.wpsquared.com/changelogs/versions/changelog/#13617Release Notes
https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026Vendor Advisory
https://www.namecheap.com/status-updates/ongoing-critical-security-vulnerability-in-cpanel-april-28-2026Third Party Advisory
https://www.vulncheck.com/advisories/cpanel-and-whm-authentication-bypass-via-login-flowThird Party Advisory
https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/Exploit, Third Party Advisory
https://www.bleepingcomputer.com/news/security/critrical-cpanel-flaw-mass-exploited-in-sorry-ransomware-attacks/Press/Media Coverage
https://github.com/watchtowrlabs/watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.pyExploit, Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41940US Government Resource

Timeline

Published: Apr 29, 2026
Last modified: Oct 26, 2026
Added to CISA KEV: Apr 30, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-419479.1Dify before version 1.14.2 contains an authorization bypass vulnerability that allows authenticated editor users to set and enable trace con CVE-2026-419489.4Dify version 1.14.1 and prior contain a path traversal vulnerability that allows authenticated users to manipulate requests forwarded to the CVE-2026-419497.5Dify before version 1.14.2 contains an authorization bypass vulnerability in the file preview endpoint that allows any authenticated user to CVE-2026-41959.8A flaw has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS CVE-2026-419506.5Dify before version 1.14.0 contains an authorization bypass vulnerability that allows authenticated users to read the full contents of files CVE-2026-419518.6Path traversal vulnerability exists in GROWI v7.5.0 and earlier, which may allow an attacker to execute arbitrary EJS templates on the serve CVE-2026-419527.8Local privilege escalation due to improper input validation. The following products are affected: Acronis DeviceLock DLP (Windows) before bu CVE-2026-419538.7A vulnerability exists in BIG-IP systems where a highly privileged, authenticated attacker with at least the Resource Administrator role can CVE-2026-419544.9Sensitive information disclosure vulnerability exists in the undisclosed iControl REST endpoint and TMOS Shell (tmsh) command which may allo CVE-2026-419567.5When a classification profile is configured on a UDP virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM)CVE-2026-419578.8An authenticated remote code execution vulnerability through undisclosed vectors exists in the BIG-IP and BIG-IQ Configuration utility. No CVE-2026-419586.5A path traversal vulnerability exists in the unzip_http RemoteZipFile extract functionality of VisiData (version(s): dev (commit 38b21f78)).