CVE-2026-41940

criticalpriority · act · 90OT risk · criticalKEV · exploitedEU KEV · CERT-PLEPSS 0.985 · 100 %ileexploit · weaponizedDEEUNLRUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 75 exploits · weaponized

Likely / severe?

98.5% (100th) EPSS

CVSS 9.8 · critical

Is it mine?

77 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

added 2026-04-30remediate by 2026-05-03

required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

EU KEVflagged by CERT-PLreported 2026-05-08patched 2026-04-28ransomware

EPSS · scored 2026-10-26

WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · disclosure@vulncheck.comexploitability 3.9 · impact 5.9

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · NCSC-NL NL

v4.09.3criticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:Nsecondary · ENISA EU

v4.09.3criticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · disclosure@vulncheck.com

v4.09.3criticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-306USCWE-306USCWE-306US

exploits (75)

Public proof-of-concept and weaponised exploit code.

exploit/multi/http/cpanel_whm_auth_bypass_rcecPanel/WHM CRLF Injection Authentication Bypass RCEweaponized · metasploit
EDB-52574cPanel - CRLF InjectionPoC · exploit_db
0dev1337/cpanelscannerCpanel Scanner For CVE-2026-41940 PoC · poc_in_github
0xBlackash/CVE-2026-41940CVE-2026-41940PoC · poc_in_github
0xYuR1/CVE-2026-41940cPanel/WHM Authentication Bypass (Zero-Day Vulnerability)PoC · poc_in_github
0xabdoulaye/CPANEL-CVE-2026-419400xabdoulaye/CPANEL-CVE-2026-41940PoC · poc_in_github

affected products (77)

Products and version ranges known to be affected.

cPanel cPanel/WHM <110.0.97all versionscert_bundDE
cPanel cPanel/WHM <110.0.98all versionscert_bundDE
cPanel cPanel/WHM <118.0.63all versionscert_bundDE
cPanel cPanel/WHM <126.0.54all versionscert_bundDE
cPanel cPanel/WHM <132.0.29all versionscert_bundDE
cPanel cPanel/WHM <134.0.20all versionscert_bundDE
cPanel cPanel/WHM< 110.0.97cert_bundDE
cPanel cPanel/WHM< 110.0.98cert_bundDE
cPanel cPanel/WHM< 118.0.63cert_bundDE
cPanel cPanel/WHM< 126.0.54cert_bundDE
cPanel cPanel/WHM< 132.0.29cert_bundDE
cPanel cPanel/WHM< 134.0.20cert_bundDE
WebPros WHM11.104.0.0 → 11.110.0.97enisa_euvdEU
WebPros WHM11.112.0.0 → 11.118.0.63enisa_euvdEU
WebPros WHM11.120.0.0 → 11.124.0.35enisa_euvdEU
WebPros WHM11.126.0.0 → 11.126.0.54enisa_euvdEU
WebPros WHM11.128.0.0 → 11.130.0.19enisa_euvdEU
WebPros WHM11.132.0.0 → 11.132.0.29enisa_euvdEU
WebPros WHM11.134.0.0 → 11.134.0.20enisa_euvdEU
WebPros WHM11.136.0.0 → 11.136.0.5enisa_euvdEU

showing 20 of 77

advisories (2)

Vendor and ecosystem advisories describing this.

NCSC-2026-0130Kwetsbaarheid verholpen in cPanel en WHMNL2026-04-30csaf · ncsc_nlNL
cPanel heeft een kwetsbaarheid verholpen in cPanel en WHM producten, inclusief versies na 11.40 en vóór de specifieke gepatchte releases.
WID-SEC-W-2026-1310cPanel cPanel/WHM: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2026-04-28csaf · cert_bundDE
Ein Angreifer kann eine Schwachstelle in cPanel cPanel/WHM ausnutzen, um Sicherheitsvorkehrungen zu umgehen.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund ncsc_nl NVD CVE.org MITRE

published 2026-04-29modified 2026-06-17

references (16)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan