Vulnerability details
CVE-2026-41940
Actively exploited
WebPros WHMWebPros WP SquaredWebPros cPanel
WebPros cPanel and WHM Authentication Bypass via Login Flow
CVSS 4.0
9.3Critical
Official description
cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.3Critical | 4.0 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| 9.8Critical | 3.1 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| WebPros | WHM | 11.104.0.0 ≤ v < 11.110.0.97 | CVEProject cvelistV5 (CNA) |
| WebPros | WHM | 11.112.0.0 ≤ v < 11.118.0.63 | CVEProject cvelistV5 (CNA) |
| WebPros | WHM | 11.120.0.0 ≤ v < 11.124.0.35 | CVEProject cvelistV5 (CNA) |
| WebPros | WHM | 11.126.0.0 ≤ v < 11.126.0.54 | CVEProject cvelistV5 (CNA) |
| WebPros | WHM | 11.128.0.0 ≤ v < 11.130.0.19 | CVEProject cvelistV5 (CNA) |
| WebPros | WHM | 11.132.0.0 ≤ v < 11.132.0.29 | CVEProject cvelistV5 (CNA) |
| WebPros | WHM | 11.134.0.0 ≤ v < 11.134.0.20 | CVEProject cvelistV5 (CNA) |
| WebPros | WHM | 11.136.0.0 ≤ v < 11.136.0.5 | CVEProject cvelistV5 (CNA) |
| WebPros | WHM | 11.40.0.0 ≤ v < 11.86.0.41 | CVEProject cvelistV5 (CNA) |
| WebPros | WHM | 11.88.0.0 ≤ v < 11.94.0.28 | CVEProject cvelistV5 (CNA) |
| WebPros | WHM | 11.96.0.0 ≤ v < 11.102.0.39 | CVEProject cvelistV5 (CNA) |
| WebPros | WP Squared | v < 11.136.1.7 | CVEProject cvelistV5 (CNA) |
| WebPros | cPanel | 11.104.0.0 ≤ v < 11.110.0.97 | CVEProject cvelistV5 (CNA) |
| WebPros | cPanel | 11.112.0.0 ≤ v < 11.118.0.63 | CVEProject cvelistV5 (CNA) |
| WebPros | cPanel | 11.120.0.0 ≤ v < 11.124.0.35 | CVEProject cvelistV5 (CNA) |
| WebPros | cPanel | 11.126.0.0 ≤ v < 11.126.0.54 | CVEProject cvelistV5 (CNA) |
| WebPros | cPanel | 11.128.0.0 ≤ v < 11.130.0.19 | CVEProject cvelistV5 (CNA) |
| WebPros | cPanel | 11.132.0.0 ≤ v < 11.132.0.29 | CVEProject cvelistV5 (CNA) |
| WebPros | cPanel | 11.134.0.0 ≤ v < 11.134.0.20 | CVEProject cvelistV5 (CNA) |
| WebPros | cPanel | 11.136.0.0 ≤ v < 11.136.0.5 | CVEProject cvelistV5 (CNA) |
| WebPros | cPanel | 11.40.0.0 ≤ v < 11.86.0.41 | CVEProject cvelistV5 (CNA) |
| WebPros | cPanel | 11.88.0.0 ≤ v < 11.94.0.28 | CVEProject cvelistV5 (CNA) |
| WebPros | cPanel | 11.96.0.0 ≤ v < 11.102.0.39 | CVEProject cvelistV5 (CNA) |
References and advisories
9- https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026 vendor-advisorypatch
- https://docs.cpanel.net/release-notes/release-notes release-notes
- https://docs.wpsquared.com/changelogs/versions/changelog/#13617 release-notes
- https://www.namecheap.com/status-updates/ongoing-critical-security-vulnerability-in-cpanel-april-28-2026 third-party-advisory
- https://www.vulncheck.com/advisories/cpanel-and-whm-authentication-bypass-via-login-flow third-party-advisory
- https://github.com/watchtowrlabs/watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py exploit
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41940 government-resource
- https://www.bleepingcomputer.com/news/security/critrical-cpanel-flaw-mass-exploited-in-sorry-ransomware-attacks/
- https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-04-29
- Last updated
- 2026-09-30
- State
- Published
- Assigner (CNA)
- VulnCheck
- Kolun priority
- 89 · Critical
CISA KEV catalog
- Date added
- 2026-04-30
- Due date
- 2026-05-03
- Used in ransomware
- Yes
Exploit prediction (EPSS)
98.52%
Probability of exploitation in 30 days
99.9%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- Active
- Technical impact
- Total
Weaknesses (CWE)
- CWE-306Missing Authentication for Critical Function