← CVE Radar
CVE-2026-41940WebPros cPanel and WHM Authentication Bypass via Login Flow
cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
9.3 CRITICALEPSS 98.52%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.3 | CRITICAL | 4.0VulnCheck (CNA) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| 9.8 | CRITICAL | 3.1VulnCheck (CNA) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
CISA required action
⚡ Known exploited · remediation due May 3, 2026
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Details
- CVE ID
- CVE-2026-41940
- Status
- Analyzed
- Assigner (CNA)
- VulnCheck
- Published
- Apr 29, 2026
- Last modified
- 2026-10-26 20:10 UTC
- Weaknesses
- CWE-306 · Missing Authentication for Critical Function
Affected Products
As published by the CNA in the CVE record.
WebProscPanel11 version ranges
- 11.40.0.0 before 11.86.0.41
- 11.88.0.0 before 11.94.0.28
- 11.96.0.0 before 11.102.0.39
- 11.104.0.0 before 11.110.0.97
- 11.112.0.0 before 11.118.0.63
- 11.120.0.0 before 11.124.0.35
- 11.126.0.0 before 11.126.0.54
- 11.128.0.0 before 11.130.0.19
- 11.132.0.0 before 11.132.0.29
- 11.134.0.0 before 11.134.0.20
- 11.136.0.0 before 11.136.0.5
WebProsWP Squared1 version range
- before 11.136.1.7
WebProsWHM11 version ranges
- 11.40.0.0 before 11.86.0.41
- 11.88.0.0 before 11.94.0.28
- 11.96.0.0 before 11.102.0.39
- 11.104.0.0 before 11.110.0.97
- 11.112.0.0 before 11.118.0.63
- 11.120.0.0 before 11.124.0.35
- 11.126.0.0 before 11.126.0.54
- 11.128.0.0 before 11.130.0.19
- 11.132.0.0 before 11.132.0.29
- 11.134.0.0 before 11.134.0.20
- 11.136.0.0 before 11.136.0.5
References
- docs.cpanel.net https://docs.cpanel.net/release-notes/release-notes
- docs.wpsquared.com https://docs.wpsquared.com/changelogs/versions/changelog/#13617
- support.cpanel.net https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026
- namecheap.com https://www.namecheap.com/status-updates/ongoing-critical-security-vulnerability-in-cpanel-april-28-2026
- vulncheck.com https://www.vulncheck.com/advisories/cpanel-and-whm-authentication-bypass-via-login-flow
- labs.watchtowr.com https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/
- bleepingcomputer.com https://www.bleepingcomputer.com/news/security/critrical-cpanel-flaw-mass-exploited-in-sorry-ransomware-attacks/
- github.com https://github.com/watchtowrlabs/watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41940