{"id":"CVE-2026-41940","kind":"vulnerability","aliases":["CVE-2026-41940"],"related":[],"title":"cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows…","description":"WAF Release - 2026-04-30 - Emergency · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nApril 30, 2026\n\n## WAF Release - 2026-04-30 - Emergency\n\nThis emergency release introduces a new rule to block a cPanel & WHM Authentication Bypass related to CVE-2026-41940.\n\nKey Findings\n\n- CVE-2026-41940: A critical authentication bypass vulnerability in cPanel & WHM allows unauthenticated remote attackers to bypass authentication mechanisms and gain unauthorized administrative access to the web hosting control panel. This vulnerability affects the session validation logic, enabling attackers to craft malicious requests that circumvent normal authentication checks.\n\nImpact\n\nSuccessful exploitation allows unauthenticated attackers to gain administrative control over affected cPanel & WHM installations. This leads to complete server compromise, potential theft or manipulation of hosted data, and significant service disruption across managed environments.\n\nWe strongly recommend applying official vendor patches for cPanel & WHM immediately to address the underlying vulnerability.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...eb2b9e2f | N/A | cPanel - Auth Bypass - CVE:CVE-2026-41940 | N/A | Block | This is a new detection. |","summary":"cPanel & WHM and WP2 (WordPress Squared) have an authentication bypass in the login flow. An unauthenticated remote attacker can gain control of the control panel, which manages hosting accounts and the server behind them.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2026-04-30T00:00:00+00:00","products":[{"name":"WebPros cPanel & WHM and WP2 (WordPress Squared)","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"cpanel","fixed":["86.0.41"],"affected":">= 11.40, < 86.0.41","ecosystem":"vendor"},{"name":"cpanel","fixed":["110.0.97"],"affected":">= 88.0.0, < 110.0.97","ecosystem":"vendor"},{"name":"cpanel","fixed":["118.0.63"],"affected":">= 112.0.0, < 118.0.63","ecosystem":"vendor"},{"name":"cpanel","fixed":["124.0.35"],"affected":">= 120.0.0, < 124.0.35","ecosystem":"vendor"},{"name":"cpanel","fixed":["126.0.54"],"affected":">= 126.0.1, < 126.0.54","ecosystem":"vendor"},{"name":"cpanel","fixed":["130.0.19"],"affected":">= 128.0.0, < 130.0.19","ecosystem":"vendor"},{"name":"cpanel","fixed":["132.0.29"],"affected":">= 132.0.0, < 132.0.29","ecosystem":"vendor"},{"name":"cpanel","fixed":["134.0.20"],"affected":">= 134.0.0, < 134.0.20","ecosystem":"vendor"},{"name":"cpanel","fixed":["136.0.5"],"affected":">= 136.0.0, < 136.0.5","ecosystem":"vendor"},{"name":"cpanel whm","fixed":["86.0.41"],"affected":">= 11.40, < 86.0.41","ecosystem":"vendor"},{"name":"cpanel whm","fixed":["110.0.97"],"affected":">= 88.0.0, < 110.0.97","ecosystem":"vendor"},{"name":"cpanel whm","fixed":["118.0.63"],"affected":">= 112.0.0, < 118.0.63","ecosystem":"vendor"},{"name":"cpanel whm","fixed":["124.0.35"],"affected":">= 120.0.0, < 124.0.35","ecosystem":"vendor"},{"name":"cpanel whm","fixed":["126.0.54"],"affected":">= 126.0.1, < 126.0.54","ecosystem":"vendor"},{"name":"cpanel whm","fixed":["130.0.19"],"affected":">= 128.0.0, < 130.0.19","ecosystem":"vendor"},{"name":"cpanel whm","fixed":["132.0.29"],"affected":">= 132.0.0, < 132.0.29","ecosystem":"vendor"},{"name":"cpanel whm","fixed":["134.0.20"],"affected":">= 134.0.0, < 134.0.20","ecosystem":"vendor"},{"name":"cpanel whm","fixed":["136.0.5"],"affected":">= 136.0.0, < 136.0.5","ecosystem":"vendor"},{"name":"cpanel wp squared","fixed":["136.1.7"],"affected":"< 136.1.7","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cloudflare","cpanel","exploited","infrastructure","lab-disclosure","ransomware","self-hosted","shared-hosting","whm","wordpress"],"not_affected_if":["managed-hosting"],"how_to_check":null,"fix":"Apply the vendor mitigation or patch from WebPros/cPanel per CISA guidance; if none is available, discontinue use of the product. Exact fixed versions: unknown","status":"open","published_at":"2026-04-29T16:16:25+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:38:36+00:00","updated_at":"2026-10-24T19:12:57+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:38:36Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation or patch from WebPros/cPanel per CISA guidance; if none is available, discontinue use of the product. Exact fixed versions: unknown","reach":"internet","summary":"cPanel & WHM and WP2 (WordPress Squared) have an authentication bypass in the login flow. An unauthenticated remote attacker can gain control of the control panel, which manages hosting accounts and the server behind them.","category":"infrastructure","who_cares":["cpanel","whm","self-hosted","shared-hosting","wordpress"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker gets full control panel access and can take over the hosting server.","analyst_note":"Find the vendor advisory and fixed cPanel/WHM and WP2 versions, plus a detection method, from the CISA KEV entry or the WebPros security advisory.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000452,"input_tokens":2623,"output_tokens":380,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-04':113C,130C '-2026':19A,22A,150C,155C,275C '-30':114C,131C '-41940':20A,23A,151C,156C,276C '11.40':6A '2026':112C,126C,129C '30':125C 'access':177C 'account':105B 'across':234C 'action':261C,263C 'address':249C 'administr':176C,210C 'affect':186C,213C 'allow':17A,165C,205C 'and':27A 'appli':240C 'april':124C 'attack':94B,168C,192C,207C 'auth':271C 'authent':9A,85B,145C,159C,171C,200C 'behind':109B 'block':141C,278C 'bypass':10A,86B,146C,160C,170C,272C 'changelog':116C,117C 'check':201C 'circumv':198C 'cloudflar':61B,123C,265C 'comment':264C 'complet':220C 'compromis':222C 'contain':7A 'control':97B,100B,182C,211C 'cpanel':1A,25A,31A,32A,33A,34A,35A,36A,37A,38A,39A,40A,42A,44A,46A,48A,50A,52A,54A,56A,58A,62B,77B,143C,163C,214C,245C,270C 'craft':194C 'critic':158C 'cve':18A,21A,149C,154C,273C,274C 'data':229C 'descript':259C 'detect':283C 'disclosur':67B 'disrupt':233C 'eb2b9e2f':268C 'emerg':115C,132C,134C 'enabl':191C 'environ':236C 'exploit':63B,204C 'find':153C 'flow':15A,90B 'gain':96B,174C,209C 'host':71B,74B,104B,181C,228C 'id':255C,258C 'immedi':247C 'impact':202C 'improv':121C 'infrastructur':64B 'instal':216C 'introduc':136C 'key':152C 'lab':66B 'lab-disclosur':65B 'lead':218C 'legaci':256C 'logic':190C 'login':14A,89B 'malici':195C 'manag':103B,235C,266C 'manipul':226C 'mechan':172C 'n/a':269C,277C 'new':118C,138C,262C,282C 'normal':199C 'offici':241C 'panel':101B,183C 'patch':243C 'potenti':223C 'previous':260C 'ransomwar':68B 'recommend':239C 'relat':147C 'releas':111C,128C,135C 'remot':93B,167C 'request':196C 'rule':139C,254C,257C 'ruleset':253C,267C 'self':70B 'self-host':69B 'server':108B,221C 'servic':232C 'session':188C 'share':73B 'shared-host':72B 'signific':231C 'squar':82B 'squared':30A,60A 'strong':238C 'success':203C 'theft':224C 'unauthent':92B,166C,206C 'unauthor':175C 'under':251C 'updat':119C 'valid':189C 'vendor':242C 'version':4A 'vulner':11A,161C,185C,252C 'waf':110C,127C 'web':180C 'webpros':24A 'whm':3A,26A,41A,43A,45A,47A,49A,51A,53A,55A,57A,75B,78B,144C,164C,215C,246C 'wordpress':29A,76B,81B 'wp':59A 'wp2':28A,80B","nicknames":[],"mitigations":[{"kind":"waf-rule","scope":null,"since":"2026-04-30","covers":"HTTP requests proxied through Cloudflare matched by the Cloudflare Managed Ruleset rule 'cPanel - Auth Bypass - CVE:CVE-2026-41940' (action Block)","limits":"Traffic not proxied through Cloudflare; non-HTTP paths; exploit variants the rule does not match, none stated otherwise","source":"https://developers.cloudflare.com/changelog/post/2026-04-30-emergency-waf-release/","vendor":"Cloudflare","seen_at":"2026-10-24T19:11:53Z","confidence":0.95,"source_title":"WAF Release - 2026-04-30 - Emergency · Changelog","customer_action":"Apply the official cPanel & WHM vendor patch immediately; the WAF rule is not a substitute for patching"}],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-04-29T16:16:25+00:00","kev":{"dateAdded":"2026-04-30","dueDate":"2026-05-03","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-41940","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-41940","severity":null,"published_at":"2026-04-30T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T12:39:21+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-41940","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41940","severity":null,"published_at":"2026-04-29T16:16:25+00:00","modified_at":"2026-09-30T18:18:18+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null},{"source":"lab","external_id":"https://developers.cloudflare.com/changelog/post/2026-04-30-emergency-waf-release/#CVE-2026-41940","url":"https://developers.cloudflare.com/changelog/post/2026-04-30-emergency-waf-release/","severity":null,"published_at":"2026-04-30T19:11:51+00:00","modified_at":null,"first_seen_at":"2026-10-24T19:12:57+00:00","fetched_at":"2026-10-24T19:12:57+00:00","note":"Cloudflare: WAF Release - 2026-04-30 - Emergency · Changelog"}],"documents":[{"id":2919,"url":"https://developers.cloudflare.com/changelog/post/2026-04-30-emergency-waf-release/","title":"Cloudflare: WAF Release - 2026-04-30 - Emergency · Changelog","kind":"advisory","source":"lab","text":"WAF Release - 2026-04-30 - Emergency · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nApril 30, 2026\n\n## WAF Release - 2026-04-30 - Emergency\n\nThis emergency release introduces a new rule to block a cPanel & WHM Authentication Bypass related to CVE-2026-41940.\n\nKey Findings\n\n- CVE-2026-41940: A critical authentication bypass vulnerability in cPanel & WHM allows unauthenticated remote attackers to bypass authentication mechanisms and gain unauthorized administrative access to the web hosting control panel. This vulnerability affects the session validation logic, enabling attackers to craft malicious requests that circumvent normal authentication checks.\n\nImpact\n\nSuccessful exploitation allows unauthenticated attackers to gain administrative control over affected cPanel & WHM installations. This leads to complete server compromise, potential theft or manipulation of hosted data, and significant service disruption across managed environments.\n\nWe strongly recommend applying official vendor patches for cPanel & WHM immediately to address the underlying vulnerability.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...eb2b9e2f | N/A | cPanel - Auth Bypass - CVE:CVE-2026-41940 | N/A | Block | This is a new detection. |","published_at":"2026-04-30T19:11:51+00:00","relation":"advisory","confidence":null,"note":"Cloudflare disclosure page"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}