CVE-2026-41940

🗓️ 29 Apr 2026 16:16:25Reported by [email protected]Type

Authentication bypass in cPanel and Web Host Manager login flow enables unauthenticated remote control panel access.

Reporter	Title	Published	Views	Family All 87
GithubExploit	Exploit for Missing Authentication for Critical Function in Cpanel	1 May 202616:27	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Cpanel	6 Jun 202612:49	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Cpanel	27 May 202600:16	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Cpanel	8 May 202614:05	–	githubexploit
GithubExploit	indo-cpanel-exploit	26 May 202619:59	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Cpanel	5 May 202623:39	–	githubexploit
GithubExploit	Exploit for CVE-2026-41940	30 Apr 202617:08	–	githubexploit
GithubExploit	Exploit for CVE-2026-41940	30 Apr 202608:11	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Cpanel	1 May 202612:09	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Cpanel	1 May 202601:34	–	githubexploit

NVD

Node

cpanel cpanelRange11.40–86.0.41

cpanel cpanelRange88.0.0–110.0.97

cpanel cpanelRange112.0.0–118.0.63

cpanel cpanelRange120.0.0–124.0.35

cpanel cpanelRange126.0.1–126.0.54

cpanel cpanelRange128.0.0–130.0.19

cpanel cpanelRange132.0.0–132.0.29

cpanel cpanelRange134.0.0–134.0.20

cpanel cpanelRange136.0.0–136.0.5

Node

cpanel whmRange11.40–86.0.41

cpanel whmRange88.0.0–110.0.97

cpanel whmRange112.0.0–118.0.63

cpanel whmRange120.0.0–124.0.35

cpanel whmRange126.0.1–126.0.54

cpanel whmRange128.0.0–130.0.19

cpanel whmRange132.0.0–132.0.29

cpanel whmRange134.0.0–134.0.20

cpanel whmRange136.0.0–136.0.5

Node

cpanel wp_squaredRange<136.1.7wordpress

Source	Link
github	www.github.com/watchtowrlabs/watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py
docs	www.docs.wpsquared.com/changelogs/versions/changelog/
labs	www.labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/
namecheap	www.namecheap.com/status-updates/ongoing-critical-security-vulnerability-in-cpanel-april-28-2026
vulncheck	www.vulncheck.com/advisories/cpanel-and-whm-authentication-bypass-via-login-flow
docs	www.docs.cpanel.net/release-notes/release-notes
support	www.support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026
bleepingcomputer	www.bleepingcomputer.com/news/security/critrical-cpanel-flaw-mass-exploited-in-sorry-ransomware-attacks/
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

04 May 2026 18:09Current

CVSS 49.3

CVSS 3.19.8

EPSS0.90543