Live › vulnerability › CVE-2026-41940
Go to dashboardcPanel & WHM and WP2 (WordPress Squared) have an authentication bypass in the login flow. An unauthenticated remote attacker can gain control of the control panel, which manages hosting accounts and the server behind them.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| WebPros cPanel & WHM and WP2 (WordPress Squared) | vendor | – | – |
| cpanel | vendor | >= 11.40, < 86.0.41 | 86.0.41 |
| cpanel | vendor | >= 88.0.0, < 110.0.97 | 110.0.97 |
| cpanel | vendor | >= 112.0.0, < 118.0.63 | 118.0.63 |
| cpanel | vendor | >= 120.0.0, < 124.0.35 | 124.0.35 |
| cpanel |
| vendor |
| >= 126.0.1, < 126.0.54 |
| 126.0.54 |
| cpanel | vendor | >= 128.0.0, < 130.0.19 | 130.0.19 |
| cpanel | vendor | >= 132.0.0, < 132.0.29 | 132.0.29 |
| cpanel | vendor | >= 134.0.0, < 134.0.20 | 134.0.20 |
| cpanel | vendor | >= 136.0.0, < 136.0.5 | 136.0.5 |
| cpanel whm | vendor | >= 11.40, < 86.0.41 | 86.0.41 |
| cpanel whm | vendor | >= 88.0.0, < 110.0.97 | 110.0.97 |
| cpanel whm | vendor | >= 112.0.0, < 118.0.63 | 118.0.63 |
| cpanel whm | vendor | >= 120.0.0, < 124.0.35 | 124.0.35 |
| cpanel whm | vendor | >= 126.0.1, < 126.0.54 | 126.0.54 |
| cpanel whm | vendor | >= 128.0.0, < 130.0.19 | 130.0.19 |
| cpanel whm | vendor | >= 132.0.0, < 132.0.29 | 132.0.29 |
| cpanel whm | vendor | >= 134.0.0, < 134.0.20 | 134.0.20 |
| cpanel whm | vendor | >= 136.0.0, < 136.0.5 | 136.0.5 |
| cpanel wp squared | vendor | < 136.1.7 | 136.1.7 |
Unknown from the sources.
What vendors did on their customers’ behalf. Holds only for traffic through them; patching is still the fix.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
WAF Release - 2026-04-30 - Emergency · Changelog
New updates and improvements at Cloudflare.
April 30, 2026
This emergency release introduces a new rule to block a cPanel & WHM Authentication Bypass related to CVE-2026-41940.
Key Findings
Impact
Successful exploitation allows unauthenticated attackers to gain administrative control over affected cPanel & WHM installations. This leads to complete server compromise, potential theft or manipulation of hosted data, and significant service disruption across managed environments.
We strongly recommend applying official vendor patches for cPanel & WHM immediately to address the underlying vulnerability.
| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
|---|---|---|---|---|---|---|
| Cloudflare Managed Ruleset | ...eb2b9e2f | N/A | cPanel - Auth Bypass - CVE:CVE-2026-41940 | N/A | Block | This is a new detection. |
This page as .md · .json · in your agent: get_signal("CVE-2026-41940")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.