Search/CVE-2026-41940
● CVE — Critical

CVE-2026-41940

VendorcpanelProductcpanel, whm, wp squaredDiscoveredApr 29, 2026UpdatedOct 26, 2026

cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

View graph Watch Export
CVSS v3.1
9.8 CRITICAL
EPSS
98.5%
probability of exploitation in 30 days
CISA KEV
Listed
confirmed active exploitation
News coverage
12
sources referencing this CVE
Related IOCs
6
seen in the same coverage
EPSS Trend
Aug 16, 2026 → Aug 26, 2026
▲ 0.60pp
97.9% → 98.5% over 3 tracked changes
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityHIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Connections
18 relationships
Timeline
disclosure → media coverage
Apr 29, 2026
Disclosure — published as a CVE record. · last revised by NVD Oct 26, 2026
Apr 30, 2026
bleepingcomputer.com reports: Critical cPanel and WHM bug exploited as a zero-day, PoC now available
Apr 30, 2026
acn.gov.it reports: cPanel & WHM e WP Squared: PoC pubblico per lo sfruttamento della CVE-2026-41940
Apr 30, 2026
helpnetsecurity.com reports: cPanel zero-day exploited for months before patch release (CVE-2026-41940)
May 1, 2026
therecord.media reports: Federal agencies must patch cPanel bug by Sunday, CISA says
May 2, 2026
bleepingcomputer.com reports: Critrical cPanel flaw mass-exploited in "Sorry" ransomware attacks
May 4, 2026
securityweek.com reports: Over 40,000 Servers Compromised in Ongoing cPanel Exploitation
May 11, 2026
thehackernews.com reports: cPanel CVE-2026-41940 Under Active Exploitation to Deploy Filemanager Backdoor
May 12, 2026
helpnetsecurity.com reports: Stealthy hackers exploit cPanel flaw in active backdoor campaign (CVE-2026-41940)
Oct 23, 2026
thehackernews.com reports: Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions
Oct 25, 2026
redhotcyber.com reports: Preparatevi all’Armageddon del ransomware! Le AI automatizzano tutto il flusso di violazione
Oct 26, 2026
theregister.com reports: Worm armed 42 GitHub repos by hiding a payload too big to fail
Oct 29, 2026
thehackernews.com reports: ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories
Public PoC (10)
github.com/Sachinart/CVE-2026-41940-cpanel-0daygithub.com/debugactiveprocess/cPanel-WHM-AuthBypass-Session-Checkergithub.com/adriyansyah-mf/cve-2026-41940-pocgithub.com/Kagantua/cPanelWHM-AuthBypassgithub.com/Wesuiliye/CVE-2026-41940github.com/assetnote/cpanel2shell-scannergithub.com/realawaisakbar/CVE-2026-41940-Exploit-PoCgithub.com/ilmndwntr/CVE-2026-41940-MASS-EXPLOITgithub.com/rfxn/cpanel-sessionscribegithub.com/0xabdoulaye/CPANEL-CVE-2026-41940
Unverified third-party code — review before executing.