How severe is CVE-2026-41940?

CVE-2026-41940 has a CVSS 3.1 base score of 9.8 (CRITICAL). EPSS estimates a 98.5% probability of exploitation in the next 30 days. It is listed in the CISA Known Exploited Vulnerabilities catalog.

CVE-2026-41940: WebPros cPanel and WHM Authentication Bypass via

CISA Known Exploited Vulnerabilities

WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.

Added to KEV

2026-04-30

Remediation due

2026-05-03

Ransomware

Known use

Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA notes
https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026 ; https://docs.cpanel.net/release-notes/release-notes/ ; https://docs.wpsquared.com/changelogs/versions/changelog/#13617 ; https://nvd.nist.gov/vuln/detail/CVE-2026-41940"

Description

cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

Severity

CVSS 4.0 · CNA9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1 · CNA9.8 CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC · CISA-ADP

Exploitationactive

Automatableyes

Technical impacttotal

Affected Products

Vendor	Product	Affected versions
WebPros	cPanel	11.40.0.0 to <11.86.0.41 11.88.0.0 to <11.94.0.28 11.96.0.0 to <11.102.0.39 11.104.0.0 to <11.110.0.97 11.112.0.0 to <11.118.0.63 11.120.0.0 to <11.124.0.35 11.126.0.0 to <11.126.0.54 11.128.0.0 to <11.130.0.19 11.132.0.0 to <11.132.0.29 11.134.0.0 to <11.134.0.20 11.136.0.0 to <11.136.0.5
WebPros	WP Squared	0 to <11.136.1.7
WebPros	WHM	11.40.0.0 to <11.86.0.41 11.88.0.0 to <11.94.0.28 11.96.0.0 to <11.102.0.39 11.104.0.0 to <11.110.0.97 11.112.0.0 to <11.118.0.63 11.120.0.0 to <11.124.0.35 11.126.0.0 to <11.126.0.54 11.128.0.0 to <11.130.0.19 11.132.0.0 to <11.132.0.29 11.134.0.0 to <11.134.0.20 11.136.0.0 to <11.136.0.5

References

7 Links

Vendor advisories

https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026

Third-party advisories

Release notes

Other references

Record Details

Published

2026-04-29

Last updated

2026-09-30

Assigner (CNA)

VulnCheck

Credited to

Related Tool Categories

Tool categories that test for or protect against this vulnerability class.

CWE-306 · Missing Authentication for Critical Function

IAM Tools Application Security Tools

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.