CVE-2026-41940

CRITICALCVSS 9.8Known Exploited

CISA Known Exploited Vulnerability

https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026 ; https://docs.cpanel.net/release-notes/release-notes/ ; https://docs.wpsquared.com/changelogs/versions/changelog/#13617 ; https://nvd.nist.gov/vuln/detail/CVE-2026-41940"

Remediation deadline: May 3, 2026

Ransomware use: Known

Description

WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

Timeline

Published:April 29th, 2026 4:16 PM

Last modified:September 30th, 2026 6:18 PM

Added to KEV:April 30th, 2026

CVSS Scoring

CVSS v3: 9.8 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Software

From NVD CPE configuration data

Vendors

cpanel

Products

cpanelwhmwp_squared

Weaknesses (CWE)

CWE-306

References & Reports

Advisories, patches, and third-party reports

Source: NIST NVD · Data may lag official sources by up to one minute