CVE-2026-41940

This flaw lets an attacker skip the normal “prove who you are” step when logging into your hosting control panel. Think of it like someone getting into your building because the door lock can be tricked during the entry check—once inside, they can move around and control what they shouldn’t.

Because it affects the login process for cPanel/WHM, a successful attack can lead to serious damage to your websites and server configuration.

This matters if you run cPanel/WHM for your business hosting (including any setup that includes WHM or cPanel web access) because the login flow can be bypassed to gain unauthorized access. It can also affect “WP Squared” installations associated with your environment.

Treat it as a risk when the vulnerable web login endpoints are reachable over the network from where attackers can reach them; cPanel/WHM login is designed for remote access, so exposed systems are the ones most likely to be targeted. CISA KEV indicates attackers have used this in ransomware campaigns.

This is RED because it’s already been used in ransomware campaigns and is listed in CISA KEV. That means the real-world attack path is known and actively abused.

Patch as fast as possible because the weakness is a login bypass—once attackers can reach the login flow, they don’t need stolen passwords or user interaction.

Confirm whether you’re exposed

1. Identify your running versions of:
   • cPanel
   • WHM (as part of the same platform)
   • WP Squared (if installed/used)
2. Compare your versions to the vendor “fixed in” list. Any versions below the fixed releases listed by cPanel may still be vulnerable.

Patch / upgrade to the fixed version

• Upgrade cPanel/WHM to at least one of the fixed cPanel versions:
  • 11.86.0.41, 11.94.0.28, 11.102.0.39, 11.110.0.97, 11.118.0.63, 11.124.0.35, 11.126.0.54, 11.130.0.19, 11.132.0.29, 11.134.0.20, or 11.136.0.5.
• If you use WP Squared, upgrade WP Squared to at least 11.136.1.7.

Timing guidance

• CISA KEV lists a remediation due date of 2026-05-03 for mitigations/updates.

If you can’t patch immediately

1. Follow the mitigations described by the cPanel security update pages linked in the findings (vendor guidance is required because interim steps can vary by environment).
2. If cPanel indicates mitigations are unavailable for your case, CISA KEV guidance says to discontinue use of the product.

After upgrading: what to monitor

• Monitor access logs for unusual or repeated login attempts around the control panel login flow.
• Review any administrative changes made around the time of suspected compromise.
• Validate that the updated components report as current after the upgrade completes.

CVE-2026-41940 (CWE-306) is an authentication bypass affecting the cPanel and WHM login flow, enabling unauthenticated remote attackers to gain unauthorized access to the control panel. The workflow-level weakness means attackers can attempt access without valid credentials or user interaction, making internet-reachable deployments especially risky.

Exploitation status: Listed in CISA KEV (added 2026-04-30) and indicated as used in ransomware campaigns; CISA remediation due date is 2026-05-03. No public exploit code is on record from the provided findings, but KEV listing elevates real-world credibility over predictions.

Fixed versions (by vendor list): cPanel is fixed in multiple releases including 11.86.0.41 and 11.136.0.5; WP Squared is fixed in 11.136.1.7. EPSS shows a high predicted likelihood (do not treat predictions as proof of exploitation; KEV is the deciding factor here).