CVE-2026-41940
WebPros cPanel, WebPros WP Squared, WebPros WHM
Published 29 Apr 2026 · updated 30 Sept 2026 · Analyzed
9.3 Critical · CVSS 4.0, vulncheck.com
Exploited in the wild
CISA added this to its Known Exploited Vulnerabilities catalog on 30 Apr 2026, with a remediation deadline of 3 May 2026 for US federal agencies. It has been used in ransomware campaigns.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
References
- docs.cpanel.net/release-notes/release-notes · Release Notes
- docs.wpsquared.com/changelogs/versions/changelog/#13617 · Release Notes
- support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026 · Vendor Advisory
- www.namecheap.com/status-updates/ongoing-critical-security-vulnerability-in-cpanel-april-28-2026 · Third Party Advisory
- www.vulncheck.com/advisories/cpanel-and-whm-authentication-bypass-via-login-flow · Third Party Advisory
- labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/ · Exploit, Third Party Advisory
- www.bleepingcomputer.com/news/security/critrical-cpanel-flaw-mass-exploited-in-sorry-ransomware-attacks/ · Press/Media Coverage
- github.com/watchtowrlabs/watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py · Exploit, Third Party Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41940 · US Government Resource