Latest cPanel & WHM vulnerability: CVE-2026-41940 #
cPanel disclosed that certain versions of cPanel & WHM are affected by a critical login authentication vulnerability. While public details are currently limited, the changelogs for the affected versions cite a fix for an issue regarding session loading and saving (CPANEL-52908), released on April 28, 2026. This vulnerability does not currently have a CVE ID assigned.
Update (April 29, 2026): New details identify this as an authentication bypass vulnerability in the login flow, enabling remote, unauthenticated attackers to gain unauthorized access to the control panel. This vulnerability has been designated CVE-2026-41940 and has been rated critical with a CVSS score of 9.8.
Update (April 30, 2026): There is evidence that this vulnerability is being actively exploited in the wild.
The following versions are affected:
- cPanel & WHM 110.0.x: Versions prior to 110.0.97 (11.110.0.97)
- cPanel & WHM 118.0.x: Versions prior to 118.0.63 (11.118.0.63)
- cPanel & WHM 126.0.x: Versions prior to 126.0.54 (11.126.0.54)
- cPanel & WHM 132.0.x: Versions prior to 132.0.29 (11.132.0.29)
- cPanel & WHM 134.0.x: Versions prior to 134.0.20 (11.134.0.20)
- cPanel & WHM 136.0.x: Versions prior to 136.0.5 (11.136.0.5)
Note: Servers running end-of-life or unsupported versions are also likely affected. It is strongly recommended that you upgrade your server to a supported, patched version immediately.
What are cPanel & WHM? #
cPanel & WHM comprises two primary components: WebHost Manager (WHM), the administrative interface for server-level infrastructure, and cPanel, the user-facing control panel for managing individual hosting accounts.
What is the impact? #
Successful exploitation of this vulnerability could allow an adversary to gain unauthorized access to affected servers.
Are updates or workarounds available? #
Users are encouraged upgrade affected systems to the following versions immediately:
- cPanel & WHM 110.0.x: 110.0.97 (11.110.0.97) or later.
- cPanel & WHM 118.0.x: 118.0.63 (11.118.0.63) or later.
- cPanel & WHM 126.0.x: 126.0.54 (11.126.0.54) or later.
- cPanel & WHM 132.0.x: 132.0.29 (11.132.0.29) or later.
- cPanel & WHM 134.0.x: 134.0.20 (11.134.0.20) or later.
- cPanel & WHM 136.0.x: 136.0.5 (11.136.0.5) or later.
- Unsupported Versions: Upgrade to one of the supported versions detailed above.
How to find potentially vulnerable systems with runZero #
From the Software Inventory, use the following query to locate potentially impacted assets:
vendor:=cPanel AND (product:=cPanel OR product:=WHM)
