--- id: "CVE-2026-41940" kind: "vulnerability" aliases: ["CVE-2026-41940"] title: "cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows\u2026" severity: "critical" cvss: 9.8 epss: null exploited: true status: "open" category: "infrastructure" products: [{"name": "WebPros cPanel & WHM and WP2 (WordPress Squared)", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "cpanel", "fixed": ["86.0.41"], "affected": ">= 11.40, < 86.0.41", "ecosystem": "vendor"}, {"name": "cpanel", "fixed": ["110.0.97"], "affected": ">= 88.0.0, < 110.0.97", "ecosystem": "vendor"}, {"name": "cpanel", "fixed": ["118.0.63"], "affected": ">= 112.0.0, < 118.0.63", "ecosystem": "vendor"}, {"name": "cpanel", "fixed": ["124.0.35"], "affected": ">= 120.0.0, < 124.0.35", "ecosystem": "vendor"}, {"name": "cpanel", "fixed": ["126.0.54"], "affected": ">= 126.0.1, < 126.0.54", "ecosystem": "vendor"}, {"name": "cpanel", "fixed": ["130.0.19"], "affected": ">= 128.0.0, < 130.0.19", "ecosystem": "vendor"}, {"name": "cpanel", "fixed": ["132.0.29"], "affected": ">= 132.0.0, < 132.0.29", "ecosystem": "vendor"}, {"name": "cpanel", "fixed": ["134.0.20"], "affected": ">= 134.0.0, < 134.0.20", "ecosystem": "vendor"}, {"name": "cpanel", "fixed": ["136.0.5"], "affected": ">= 136.0.0, < 136.0.5", "ecosystem": "vendor"}, {"name": "cpanel whm", "fixed": ["86.0.41"], "affected": ">= 11.40, < 86.0.41", "ecosystem": "vendor"}, {"name": "cpanel whm", "fixed": ["110.0.97"], "affected": ">= 88.0.0, < 110.0.97", "ecosystem": "vendor"}, {"name": "cpanel whm", "fixed": ["118.0.63"], "affected": ">= 112.0.0, < 118.0.63", "ecosystem": "vendor"}, {"name": "cpanel whm", "fixed": ["124.0.35"], "affected": ">= 120.0.0, < 124.0.35", "ecosystem": "vendor"}, {"name": "cpanel whm", "fixed": ["126.0.54"], "affected": ">= 126.0.1, < 126.0.54", "ecosystem": "vendor"}, {"name": "cpanel whm", "fixed": ["130.0.19"], "affected": ">= 128.0.0, < 130.0.19", "ecosystem": "vendor"}, {"name": "cpanel whm", "fixed": ["132.0.29"], "affected": ">= 132.0.0, < 132.0.29", "ecosystem": "vendor"}, {"name": "cpanel whm", "fixed": ["134.0.20"], "affected": ">= 134.0.0, < 134.0.20", "ecosystem": "vendor"}, {"name": "cpanel whm", "fixed": ["136.0.5"], "affected": ">= 136.0.0, < 136.0.5", "ecosystem": "vendor"}, {"name": "cpanel wp squared", "fixed": ["136.1.7"], "affected": "< 136.1.7", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["cloudflare", "cpanel", "exploited", "infrastructure", "lab-disclosure", "ransomware", "self-hosted", "shared-hosting", "whm", "wordpress"] not_affected_if: ["managed-hosting"] published_at: "2026-04-29T16:16:25+00:00" first_seen_at: "2026-10-23T19:11:51+00:00" updated_at: "2026-10-24T19:12:57+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-41940", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41940", "first_seen_at": "2026-10-23T23:44:51+00:00"}, {"source": "lab", "url": "https://developers.cloudflare.com/changelog/post/2026-04-30-emergency-waf-release/", "first_seen_at": "2026-10-24T19:12:57+00:00"}] --- # cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows… cPanel & WHM and WP2 (WordPress Squared) have an authentication bypass in the login flow. An unauthenticated remote attacker can gain control of the control panel, which manages hosting accounts and the server behind them. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:WebPros cPanel & WHM and WP2 (WordPress Squared) affected ? fixed ? - vendor:cpanel affected >= 11.40, < 86.0.41 fixed 86.0.41 - vendor:cpanel affected >= 88.0.0, < 110.0.97 fixed 110.0.97 - vendor:cpanel affected >= 112.0.0, < 118.0.63 fixed 118.0.63 - vendor:cpanel affected >= 120.0.0, < 124.0.35 fixed 124.0.35 - vendor:cpanel affected >= 126.0.1, < 126.0.54 fixed 126.0.54 - vendor:cpanel affected >= 128.0.0, < 130.0.19 fixed 130.0.19 - vendor:cpanel affected >= 132.0.0, < 132.0.29 fixed 132.0.29 - vendor:cpanel affected >= 134.0.0, < 134.0.20 fixed 134.0.20 - vendor:cpanel affected >= 136.0.0, < 136.0.5 fixed 136.0.5 - vendor:cpanel whm affected >= 11.40, < 86.0.41 fixed 86.0.41 - vendor:cpanel whm affected >= 88.0.0, < 110.0.97 fixed 110.0.97 - vendor:cpanel whm affected >= 112.0.0, < 118.0.63 fixed 118.0.63 - vendor:cpanel whm affected >= 120.0.0, < 124.0.35 fixed 124.0.35 - vendor:cpanel whm affected >= 126.0.1, < 126.0.54 fixed 126.0.54 - vendor:cpanel whm affected >= 128.0.0, < 130.0.19 fixed 130.0.19 - vendor:cpanel whm affected >= 132.0.0, < 132.0.29 fixed 132.0.29 - vendor:cpanel whm affected >= 134.0.0, < 134.0.20 fixed 134.0.20 - vendor:cpanel whm affected >= 136.0.0, < 136.0.5 fixed 136.0.5 - vendor:cpanel wp squared affected < 136.1.7 fixed 136.1.7 ## Fix Apply the vendor mitigation or patch from WebPros/cPanel per CISA guidance; if none is available, discontinue use of the product. Exact fixed versions: unknown ## Mitigated for you by - Cloudflare (waf-rule, since 2026-04-30): covers HTTP requests proxied through Cloudflare matched by the Cloudflare Managed Ruleset rule 'cPanel - Auth Bypass - CVE:CVE-2026-41940' (action Block) Limits: Traffic not proxied through Cloudflare; non-HTTP paths; exploit variants the rule does not match, none stated otherwise Still: Apply the official cPanel & WHM vendor patch immediately; the WAF rule is not a substitute for patching https://developers.cloudflare.com/changelog/post/2026-04-30-emergency-waf-release/ ## Timeline - 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-41940 - 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-41940 - 2026-10-24T19:12:57+00:00 lab https://developers.cloudflare.com/changelog/post/2026-04-30-emergency-waf-release/ — Cloudflare: WAF Release - 2026-04-30 - Emergency · Changelog ## Documents - [advisory] Cloudflare: WAF Release - 2026-04-30 - Emergency · Changelog https://developers.cloudflare.com/changelog/post/2026-04-30-emergency-waf-release/ ## From the sources WAF Release - 2026-04-30 - Emergency · Changelog # Changelog New updates and improvements at Cloudflare. April 30, 2026 ## WAF Release - 2026-04-30 - Emergency This emergency release introduces a new rule to block a cPanel & WHM Authentication Bypass related to CVE-2026-41940. Key Findings - CVE-2026-41940: A critical authentication bypass vulnerability in cPanel & WHM allows unauthenticated remote attackers to bypass authentication mechanisms and gain unauthorized administrative access to the web hosting control panel. This vulnerability affects the session validation logic, enabling attackers to craft malicious requests that circumvent normal authentication checks. Impact Successful exploitation allows unauthenticated attackers to gain administrative control over affected cPanel & WHM installations. This leads to complete server compromise, potential theft or manipulation of hosted data, and significant service disruption across managed environments. We strongly recommend applying official vendor patches for cPanel & WHM immediately to address the underlying vulnerability. | Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments | | --- | --- | --- | --- | --- | --- | --- | | Cloudflare Managed Ruleset | ...eb2b9e2f | N/A | cPanel - Auth Bypass - CVE:CVE-2026-41940 | N/A | Block | This is a new detection. | --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_