CVE-2026-41940

Published: Apr 29, 2026Modified: Sep 30, 2026CISA KEV

9.3

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

Affected (19)

Products: Cpanel: Cpanel, Whm, Wp Squared

3 products

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Cpanel Cpanel	11.40 ≤ version < 86.0.41
Cpanel Cpanel	112.0.0 ≤ version < 118.0.63
Cpanel Cpanel	120.0.0 ≤ version < 124.0.35
Cpanel Cpanel	126.0.1 ≤ version < 126.0.54
Cpanel Cpanel	128.0.0 ≤ version < 130.0.19
Cpanel Cpanel	132.0.0 ≤ version < 132.0.29
Cpanel Cpanel	134.0.0 ≤ version < 134.0.20
Cpanel Cpanel	136.0.0 ≤ version < 136.0.5
Cpanel Cpanel	88.0.0 ≤ version < 110.0.97

Configuration B

9 vulnerable

Vulnerable Software	Affected Versions
Cpanel Whm	11.40 ≤ version < 86.0.41
Cpanel Whm	112.0.0 ≤ version < 118.0.63
Cpanel Whm	120.0.0 ≤ version < 124.0.35
Cpanel Whm	126.0.1 ≤ version < 126.0.54
Cpanel Whm	128.0.0 ≤ version < 130.0.19
Cpanel Whm	132.0.0 ≤ version < 132.0.29
Cpanel Whm	134.0.0 ≤ version < 134.0.20
Cpanel Whm	136.0.0 ≤ version < 136.0.5
Cpanel Whm	88.0.0 ≤ version < 110.0.97