CVE-2026-41940

Published Apr 29, 2026

Last updated a month ago

Exploit known CVSS critical 9.3

cPanel

lms

web application

Zero-day

WHM

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-41940 is an authentication bypass vulnerability impacting cPanel & WHM and WP Squared products. This flaw allows unauthenticated remote attackers to bypass the login process and gain unauthorized administrative access to affected systems. The vulnerability stems from a Carriage Return Line Feed (CRLF) injection within the login and session loading mechanisms of cPanel & WHM, where an attacker can manipulate the `whostmgrsession` cookie to circumvent encryption. Successful exploitation of CVE-2026-41940 grants an attacker control over the cPanel host system, including its configurations, databases, and the websites it manages. Security firm watchTowr Labs has published a technical analysis and proof-of-concept exploit for this vulnerability, detailed in their blog post titled "The Internet Is Falling Down, Falling Down, Falling Down (cPanel & WHM Authentication Bypass CVE-2026-41940)". The vulnerability affects cPanel and WHM versions after 11.40, with patches available in later versions.

Description: cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
Source: disclosure@vulncheck.com
NVD status: Analyzed
Products: cpanel, whm, wp_squared

Insights

Analysis from the Intruder Security Team

Published Apr 30, 2026 Updated Apr 30, 2026

cPanel is a very popular hosting framework which is often very difficult to avoid exposing to the internet. The exploit for this weakness gives the attacker root access to cPanel (and from there easy RCE on the system), and the exploit is reliable, well documented, and affects all versions of cPanel except the latest patch. There are well over a million hosts exposed, and though cPanel does have some automated self-upgrade functionality, it can be turned off, and the window before an upgrade (usually up to 24h) is long enough for attacker to have already exploited this weakness. cPanel have provided a script you can use to detect if compromise has already occurred, which can be found here.

Risk scores

CVSS 4.0

Type: Secondary
Base score: 9.3
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: CRITICAL

CVSS 3.1

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability
Exploit added on: Apr 30, 2026
Exploit action due: May 3, 2026
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

disclosure@vulncheck.com: CWE-306

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "D018D47F-B020-41B1-8755-9197EB8673D3",
            "versionEndExcluding": "86.0.41",
            "versionStartIncluding": "11.40",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "9BF3DBAC-D629-44A9-B102-2D8F82709CA2",
            "versionEndExcluding": "110.0.97",
            "versionStartIncluding": "88.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "3EEFF12C-11E8-4A5C-9C72-BA1A422A9E72",
            "versionEndExcluding": "118.0.63",
            "versionStartIncluding": "112.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "5533AA73-5007-4820-A5C6-0460C486882D",
            "versionEndExcluding": "124.0.35",
            "versionStartIncluding": "120.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "15C0513D-8C56-4C5F-B818-E2CE90223AD4",
            "versionEndExcluding": "126.0.54",
            "versionStartIncluding": "126.0.1",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "B5FE32EC-AEFB-4B27-AE65-A95432CAA812",
            "versionEndExcluding": "130.0.19",
            "versionStartIncluding": "128.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "24982921-6C0D-478E-BBF1-7C9DC7023760",
            "versionEndExcluding": "132.0.29",
            "versionStartIncluding": "132.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "B0213A2B-4A5A-4098-87FF-517E33F96807",
            "versionEndExcluding": "134.0.20",
            "versionStartIncluding": "134.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "09F99F08-1FB9-4BC6-8C7D-52062BA28479",
            "versionEndExcluding": "136.0.5",
            "versionStartIncluding": "136.0.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "63BE6DEF-A6EA-4545-9A3D-E1BA84A50EC7",
            "versionEndExcluding": "86.0.41",
            "versionStartIncluding": "11.40",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "74E9C069-EA63-4B95-9229-45AD97563532",
            "versionEndExcluding": "110.0.97",
            "versionStartIncluding": "88.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "2FCD52CF-3F10-4FFA-8FC7-AA5F370AF9B8",
            "versionEndExcluding": "118.0.63",
            "versionStartIncluding": "112.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "2ED81103-D03E-4351-9C19-1B3F120268D6",
            "versionEndExcluding": "124.0.35",
            "versionStartIncluding": "120.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "6DC3D6F0-8D07-4719-977E-DB978AEB7A67",
            "versionEndExcluding": "126.0.54",
            "versionStartIncluding": "126.0.1",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "C6C216F5-330D-4DAA-B042-1A4707FF658E",
            "versionEndExcluding": "130.0.19",
            "versionStartIncluding": "128.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "8793EED8-BDBD-4CC8-9698-FCEE769CFB5B",
            "versionEndExcluding": "132.0.29",
            "versionStartIncluding": "132.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "53AC31A0-AD91-4897-89E7-1C05AF03BF5A",
            "versionEndExcluding": "134.0.20",
            "versionStartIncluding": "134.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "23D646D3-2BDC-44C8-8C5F-9E21B0613A48",
            "versionEndExcluding": "136.0.5",
            "versionStartIncluding": "136.0.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:cpanel:wp_squared:*:*:*:*:*:wordpress:*:*",
            "matchCriteriaId": "80392939-B45D-4C12-ADBB-334E783BDE67",
            "versionEndExcluding": "136.1.7",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.