Actively exploited · Published Apr 29, 2026 · Assigned by VulnCheck
CVE-2026-41940WebPros cPanel and WHM Authentication Bypass via Login Flow
Critical 9.8 Exploited Ransomware
In plain English
A critical-severity missing authentication in cPanel from WebPros. Attackers are actively exploiting it in the wild (listed by CISA on April 30, 2026). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 98.5% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by May 3, 2026.
Official description
cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WebPros | cPanel | 11.40.0.0 – before 11.86.0.4111.88.0.0 – before 11.94.0.2811.96.0.0 – before 11.102.0.3911.104.0.0 – before 11.110.0.9711.112.0.0 – before 11.118.0.6311.120.0.0 – before 11.124.0.3511.126.0.0 – before 11.126.0.5411.128.0.0 – before 11.130.0.19 |
| WebPros | WP Squared | 0 – before 11.136.1.7 |
| WebPros | WHM | 11.40.0.0 – before 11.86.0.4111.88.0.0 – before 11.94.0.2811.96.0.0 – before 11.102.0.3911.104.0.0 – before 11.110.0.9711.112.0.0 – before 11.118.0.6311.120.0.0 – before 11.124.0.3511.126.0.0 – before 11.126.0.5411.128.0.0 – before 11.130.0.19 |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026 vendor-advisory, patch
- https://docs.cpanel.net/release-notes/release-notes release-notes
- https://docs.wpsquared.com/changelogs/versions/changelog/#13617 release-notes
- https://www.namecheap.com/status-updates/ongoing-critical-security-vulnerability-in-cpanel-april-28-2026 third-party-advisory
- https://www.vulncheck.com/advisories/cpanel-and-whm-authentication-bypass-via-login-flow third-party-advisory
- https://github.com/watchtowrlabs/watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py exploit
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41940 government-resource
- https://www.bleepingcomputer.com/news/security/critrical-cpanel-flaw-mass-exploited-in-sorry-ransomware-attacks/
- https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/