CVE catalog
CVE-2026-41940
cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
- Severity
- Critical · CVSS 9.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Published
- Source
- [NVD] · [CVE record]
- Exploitation
- CISA Known Exploited Vulnerabilities
- EPSS
- 98.53% · Oct 25, 2026
WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Cpe | cpanel | Not reported | 86.0.41 | fixed |
| Cpe | cpanel | Not reported | 110.0.97 | fixed |
| Cpe | cpanel | Not reported | 118.0.63 | fixed |
| Cpe | cpanel | Not reported | 124.0.35 | fixed |
| Cpe | cpanel | Not reported | 126.0.54 | fixed |
| Cpe | cpanel | Not reported | 130.0.19 | fixed |
| Cpe | cpanel | Not reported | 132.0.29 | fixed |
| Cpe | cpanel | Not reported | 134.0.20 | fixed |
| Cpe | cpanel | Not reported | 136.0.5 | fixed |
| Cpe | whm | Not reported | 86.0.41 | fixed |
| Cpe | whm | Not reported | 110.0.97 | fixed |
| Cpe | whm | Not reported | 118.0.63 | fixed |
| Cpe | whm | Not reported | 124.0.35 | fixed |
| Cpe | whm | Not reported | 126.0.54 | fixed |
| Cpe | whm | Not reported | 130.0.19 | fixed |
| Cpe | whm | Not reported | 132.0.29 | fixed |
| Cpe | whm | Not reported | 134.0.20 | fixed |
| Cpe | whm | Not reported | 136.0.5 | fixed |
| Cpe | wp_squared | Not reported | 136.1.7 | fixed |
| Cpe | cpanel | Not reported | 136.0.5 | fixed |
| Cpe | whm | Not reported | 136.0.5 | fixed |
| Cpe | wp_squared | Not reported | 136.1.7 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Cpe | cpanel | cpe | Not reported | 86.0.41 | Not reported | Not reported | Not reported |
| Cpe | cpanel | cpe | Not reported | 110.0.97 | Not reported | Not reported | Not reported |
| Cpe | cpanel | cpe | Not reported | 118.0.63 | Not reported | Not reported | Not reported |
| Cpe | cpanel | cpe | Not reported | 124.0.35 | Not reported | Not reported | Not reported |
| Cpe | cpanel | cpe | Not reported | 126.0.54 | Not reported | Not reported | Not reported |
| Cpe | cpanel | cpe | Not reported | 130.0.19 | Not reported | Not reported | Not reported |
| Cpe | cpanel | cpe | Not reported | 132.0.29 | Not reported | Not reported | Not reported |
| Cpe | cpanel | cpe | Not reported | 134.0.20 | Not reported | Not reported | Not reported |
| Cpe | cpanel | cpe | Not reported | 136.0.5 | Not reported | Not reported | Not reported |
| Cpe | whm | cpe | Not reported | 86.0.41 | Not reported | Not reported | Not reported |
| Cpe | whm | cpe | Not reported | 110.0.97 | Not reported | Not reported | Not reported |
| Cpe | whm | cpe | Not reported | 118.0.63 | Not reported | Not reported | Not reported |
| Cpe | whm | cpe | Not reported | 124.0.35 | Not reported | Not reported | Not reported |
| Cpe | whm | cpe | Not reported | 126.0.54 | Not reported | Not reported | Not reported |
| Cpe | whm | cpe | Not reported | 130.0.19 | Not reported | Not reported | Not reported |
| Cpe | whm | cpe | Not reported | 132.0.29 | Not reported | Not reported | Not reported |
| Cpe | whm | cpe | Not reported | 134.0.20 | Not reported | Not reported | Not reported |
| Cpe | whm | cpe | Not reported | 136.0.5 | Not reported | Not reported | Not reported |
| Cpe | wp_squared | cpe | Not reported | 136.1.7 | Not reported | Not reported | Not reported |
| Cpe | cpanel | cpe | Not reported | 136.0.5 | Not reported | NVD-CVE-2026-41940 | Not reported |
| Cpe | whm | cpe | Not reported | 136.0.5 | Not reported | NVD-CVE-2026-41940 | Not reported |
| Cpe | wp_squared | cpe | Not reported | 136.1.7 | Not reported | NVD-CVE-2026-41940 | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed:
References
- [https://docs.cpanel.net/release-notes/release-notes]
- [https://docs.wpsquared.com/changelogs/versions/changelog/#13617]
- [https://github.com/watchtowrlabs/watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py]
- [https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-41940]
- [https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1310.json]
- [https://www.bleepingcomputer.com/news/security/critrical-cpanel-flaw-mass-exploited-in-sorry-ransomware-attacks/]
- [https://www.cisa.gov/known-exploited-vulnerabilities-catalog]
- [https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41940]
- [https://www.namecheap.com/status-updates/ongoing-critical-security-vulnerability-in-cpanel-april-28-2026]
- [https://www.vulncheck.com/advisories/cpanel-and-whm-authentication-bypass-via-login-flow]
[CERT-Bund public advisories] · [CISA Known Exploited Vulnerabilities (OSINT)] · [FIRST EPSS] · [National Vulnerability Database (NVD)]