Back to KEVs

CVE-2026-41940

WebPros cPanel and WHM Authentication Bypass via Login Flow

Basic Information

CVE State
PUBLISHED
Reserved Date
April 22, 2026
Published Date
April 29, 2026
Last Updated
May 06, 2026
Vendor
WebPros
Product
cPanel, WP Squared, WHM
Description
cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
Tags
cisa nuclei_scanner

CVSS Scores

CVSS v4.0

9.3 - CRITICAL

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS v3.1

9.8 - CRITICAL

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC Information

Exploitation
active
Automatable
Yes
Technical Impact
total

Exploit Status

Exploited in the Wild
Yes (2026-06-01 13:26:04 UTC) Source

References

https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026 https://docs.cpanel.net/release-notes/release-notes https://docs.wpsquared.com/changelogs/versions/changelog/#13617 https://www.namecheap.com/status-updates/ongoing-critical-security-vulnerability-in-cpanel-april-28-2026 https://www.vulncheck.com/advisories/cpanel-and-whm-authentication-bypass-via-login-flow

Known Exploited Vulnerability Information

Source Added Date
CVE 2026-06-01 13:26:04 UTC

Scanner Integrations

Scanner URL Date Detected
Nuclei https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-41940.yaml 2026-06-01 15:34:45 UTC

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Added to KEVIntel

  • Detected by Nuclei