- Critical 9.3
- Known exploited (CISA KEV)
- Used in ransomware (CISA)
CVE-2026-41940
cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
Scores
The facts
- Published
- 29 April 2026
- Last changed
- 30 September 2026
- NVD status
- Analyzed
- Severity
- Critical, CVSS 9.3 out of 10 (version 4.0)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R… - Weakness
- Affects
- cpanel cpanel
- cpanel whm
- cpanel wp squared
- Known exploited
- Yes. CISA added it to the Known Exploited Vulnerabilities catalogue on 30 April 2026. CISA lists it as used in ransomware campaigns.
- EPSS
- 98.5% chance of exploitation activity in the next 30 days (percentile 100).
Is there a Securelyn advisory?
Not yet. Securelyn writes plain-English advisories for the flaws that matter most to businesses. Subscribe to the digest to hear about them.