CVE-2026-41940
WebPros cPanel and WHM Authentication Bypass via Login Flow
- State
- Published
- Severity
- 9.3 Critical
- Published
- Apr 29, 2026
- Updated
- Sep 30, 2026
- Reserved
- Apr 22, 2026
Description
cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-306 Missing Authentication for Critical Function
Affected Products
| Product | Versions |
|---|---|
cPanelWebPros |
|
WP SquaredWebPros |
|
WHMWebPros |
|
References
- https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026vendor-advisorypatch
- https://docs.cpanel.net/release-notes/release-notesrelease-notes
- https://docs.wpsquared.com/changelogs/versions/changelog/#13617release-notes
- https://www.namecheap.com/status-updates/ongoing-critical-security-vulnerability-in-cpanel-april-28-2026third-party-advisory
- https://www.vulncheck.com/advisories/cpanel-and-whm-authentication-bypass-via-login-flowthird-party-advisory
- https://github.com/watchtowrlabs/watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.pyexploit
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41940government-resource
- https://www.bleepingcomputer.com/news/security/critrical-cpanel-flaw-mass-exploited-in-sorry-ransomware-attacks/
- https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.