CVE-2026-41940
Full vulnerability record from the local CVENow database.
Description
cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
Severity
CRITICAL
CVSS score
9.3
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-04-29 16:16:25.037000
Last modified
2026-10-26 20:10:00.160000
View original CVE JSON
{
"id": "CVE-2026-41940",
"sourceIdentifier": "[email protected]",
"published": "2026-04-29T16:16:25.037",
"lastModified": "2026-10-26T20:10:00.160",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel."
},
{
"lang": "es",
"value": "Las versiones de cPanel y WHM posteriores a la 11.40 contienen una vulnerabilidad de omisión de autenticación en el flujo de inicio de sesión que permite a atacantes remotos no autenticados obtener acceso no autorizado al panel de control."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "WebPros",
"product": "cPanel",
"defaultStatus": "affected",
"versions": [
{
"version": "11.40.0.0",
"lessThan": "11.86.0.41",
"versionType": "custom",
"status": "affected"
},
{
"version": "11.88.0.0",
"lessThan": "11.94.0.28",
"versionType": "custom",
"status": "affected"
},
{
"version": "11.96.0.0",
"lessThan": "11.102.0.39",
"versionType": "custom",
"status": "affected"
},
{
"version": "11.104.0.0",
"lessThan": "11.110.0.97",
"versionType": "custom",
"status": "affected"
},
{
"version": "11.112.0.0",
"lessThan": "11.118.0.63",
"versionType": "custom",
"status": "affected"
},
{
"version": "11.120.0.0",
"lessThan": "11.124.0.35",
"versionType": "custom",
"status": "affected"
},
{
"version": "11.126.0.0",
"lessThan": "11.126.0.54",
"versionType": "custom",
"status": "affected"
},
{
"version": "11.128.0.0",
"lessThan": "11.130.0.19",
"versionType": "custom",
"status": "affected"
},
{
"version": "11.132.0.0",
"lessThan": "11.132.0.29",
"versionType": "custom",
"status": "affected"
},
{
"version": "11.134.0.0",
"lessThan": "11.134.0.20",
"versionType": "custom",
"status": "affected"
},
{
"version": "11.136.0.0",
"lessThan": "11.136.0.5",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "WebPros",
"product": "WP Squared",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "11.136.1.7",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "WebPros",
"product": "WHM",
"defaultStatus": "affected",
"versions": [
{
"version": "11.40.0.0",
"lessThan": "11.86.0.41",
"versionType": "custom",
"status": "affected"
},
{
"version": "11.88.0.0",
"lessThan": "11.94.0.28",
"versionType": "custom",
"status": "affected"
},
{
"version": "11.96.0.0",
"lessThan": "11.102.0.39",
"versionType": "custom",
"status": "affected"
},
{
"version": "11.104.0.0",
"lessThan": "11.110.0.97",
"versionType": "custom",
"status": "affected"
},
{
"version": "11.112.0.0",
"lessThan": "11.118.0.63",
"versionType": "custom",
"status": "affected"
},
{
"version": "11.120.0.0",
"lessThan": "11.124.0.35",
"versionType": "custom",
"status": "affected"
},
{
"version": "11.126.0.0",
"lessThan": "11.126.0.54",
"versionType": "custom",
"status": "affected"
},
{
"version": "11.128.0.0",
"lessThan": "11.130.0.19",
"versionType": "custom",
"status": "affected"
},
{
"version": "11.132.0.0",
"lessThan": "11.132.0.29",
"versionType": "custom",
"status": "affected"
},
{
"version": "11.134.0.0",
"lessThan": "11.134.0.20",
"versionType": "custom",
"status": "affected"
},
{
"version": "11.136.0.0",
"lessThan": "11.136.0.5",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-29T00:00:00+00:00",
"id": "CVE-2026-41940",
"options": [
{
"exploitation": "active"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"cisaExploitAdd": "2026-04-30",
"cisaActionDue": "2026-05-03",
"cisaRequiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
"cisaVulnerabilityName": "WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability",
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-306"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "11.40",
"versionEndExcluding": "86.0.41",
"matchCriteriaId": "D018D47F-B020-41B1-8755-9197EB8673D3"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "88.0.0",
"versionEndExcluding": "110.0.97",
"matchCriteriaId": "9BF3DBAC-D629-44A9-B102-2D8F82709CA2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "112.0.0",
"versionEndExcluding": "118.0.63",
"matchCriteriaId": "3EEFF12C-11E8-4A5C-9C72-BA1A422A9E72"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "120.0.0",
"versionEndExcluding": "124.0.35",
"matchCriteriaId": "5533AA73-5007-4820-A5C6-0460C486882D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "126.0.1",
"versionEndExcluding": "126.0.54",
"matchCriteriaId": "15C0513D-8C56-4C5F-B818-E2CE90223AD4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "128.0.0",
"versionEndExcluding": "130.0.19",
"matchCriteriaId": "B5FE32EC-AEFB-4B27-AE65-A95432CAA812"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "132.0.0",
"versionEndExcluding": "132.0.29",
"matchCriteriaId": "24982921-6C0D-478E-BBF1-7C9DC7023760"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "134.0.0",
"versionEndExcluding": "134.0.20",
"matchCriteriaId": "B0213A2B-4A5A-4098-87FF-517E33F96807"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "136.0.0",
"versionEndExcluding": "136.0.5",
"matchCriteriaId": "09F99F08-1FB9-4BC6-8C7D-52062BA28479"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:*",
"versionStartIncluding": "11.40",
"versionEndExcluding": "86.0.41",
"matchCriteriaId": "63BE6DEF-A6EA-4545-9A3D-E1BA84A50EC7"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:*",
"versionStartIncluding": "88.0.0",
"versionEndExcluding": "110.0.97",
"matchCriteriaId": "74E9C069-EA63-4B95-9229-45AD97563532"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:*",
"versionStartIncluding": "112.0.0",
"versionEndExcluding": "118.0.63",
"matchCriteriaId": "2FCD52CF-3F10-4FFA-8FC7-AA5F370AF9B8"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:*",
"versionStartIncluding": "120.0.0",
"versionEndExcluding": "124.0.35",
"matchCriteriaId": "2ED81103-D03E-4351-9C19-1B3F120268D6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:*",
"versionStartIncluding": "126.0.1",
"versionEndExcluding": "126.0.54",
"matchCriteriaId": "6DC3D6F0-8D07-4719-977E-DB978AEB7A67"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:*",
"versionStartIncluding": "128.0.0",
"versionEndExcluding": "130.0.19",
"matchCriteriaId": "C6C216F5-330D-4DAA-B042-1A4707FF658E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:*",
"versionStartIncluding": "132.0.0",
"versionEndExcluding": "132.0.29",
"matchCriteriaId": "8793EED8-BDBD-4CC8-9698-FCEE769CFB5B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:*",
"versionStartIncluding": "134.0.0",
"versionEndExcluding": "134.0.20",
"matchCriteriaId": "53AC31A0-AD91-4897-89E7-1C05AF03BF5A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:*",
"versionStartIncluding": "136.0.0",
"versionEndExcluding": "136.0.5",
"matchCriteriaId": "23D646D3-2BDC-44C8-8C5F-9E21B0613A48"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cpanel:wp_squared:*:*:*:*:*:wordpress:*:*",
"versionEndExcluding": "136.1.7",
"matchCriteriaId": "80392939-B45D-4C12-ADBB-334E783BDE67"
}
]
}
]
}
],
"references": [
{
"url": "https://docs.cpanel.net/release-notes/release-notes",
"source": "[email protected]",
"tags": [
"Release Notes"
]
},
{
"url": "https://docs.wpsquared.com/changelogs/versions/changelog/#13617",
"source": "[email protected]",
"tags": [
"Release Notes"
]
},
{
"url": "https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://www.namecheap.com/status-updates/ongoing-critical-security-vulnerability-in-cpanel-april-28-2026",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://www.vulncheck.com/advisories/cpanel-and-whm-authentication-bypass-via-login-flow",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
]
},
{
"url": "https://www.bleepingcomputer.com/news/security/critrical-cpanel-flaw-mass-exploited-in-sorry-ransomware-attacks/",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Press/Media Coverage"
]
},
{
"url": "https://github.com/watchtowrlabs/watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Exploit",
"Third Party Advisory"
]
},
{
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41940",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"US Government Resource"
]
}
]
}