CVE-2026-41940

cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

CVSS 4.0

9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

99% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-25)

CISA KEV

listed 2026-04-30, due 2026-05-03, known ransomware use

CWE

CWE-306

Published

2026-04-29

Modified

2026-09-30

Record from

the NVD, synced 2026-10-19

Affected

• cpanel:cpanel
• cpanel:whm
• cpanel:wp_squared

References

• https://docs.cpanel.net/release-notes/release-notes
• https://docs.wpsquared.com/changelogs/versions/changelog/#13617
• https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026
• https://www.namecheap.com/status-updates/ongoing-critical-security-vulnerability-in-cpanel-april-28-2026
• https://www.vulncheck.com/advisories/cpanel-and-whm-authentication-bypass-via-login-flow

Check your stackJSON