Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-41940 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-04-29 |
| Vendor | cPanel |
| Product | cPanel & WHM |
| CVSS Score | 9.8 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
cPanel and WHM versions prior to 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, and 11.136.0.5 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
Required Actions
Update cPanel and WHM to one of the patched versions immediately: 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, or 11.136.0.5 (depending on your branch). Until updated, restrict access to login ports (2082, 2083, 2086, 2087) to trusted IP addresses only. Review logs for unauthorized login attempts and suspicious admin sessions.
Who Is Affected?
This vulnerability affects cPanel & WHM by cPanel. Check whether your organization manages cPanel/WHM servers (typical for hosting and shared-services providers) and roll out the update without delay.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
