CVE-2026-41940 — Cpanel Vulnerability Details

What is CVE-2026-41940?

cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

The record classifies CVE-2026-41940 under weakness class CWE-306. Its CVSS v3 base vector states that the flaw is reachable remotely over the network, needs no prior authentication, needs no user interaction, and has high impact on confidentiality, integrity, availability. 2 affected-product entries are recorded, across 1 vendor, listed below. The identifier was first published 182 days ago.

Severity and exploitation probability

CVSS v3.1 base score: 9.8 — CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0 base score: 9.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (FIRST): 98.5% probability of exploitation in the next 30 days, higher than 99.9% of all scored CVEs
CISA KEV: Listed since 2026-04-30, federal remediation deadline 2026-05-03 — used in known ransomware campaigns
Threadlinqs priority: 10/10 — CISA lists it as used in ransomware, which Threadlinqs scores at the maximum
Published: 2026-04-29, last modified 2026-09-30

Is CVE-2026-41940 being exploited?

CISA added CVE-2026-41940 to the Known Exploited Vulnerabilities catalog on 2026-04-30, which means the agency holds evidence of exploitation in the wild; US federal civilian agencies had to remediate it by 2026-05-03 under BOD 22-01. CISA flags the vulnerability as one used in known ransomware campaigns. Weaponised exploit code for CVE-2026-41940 is publicly available. 11 public proof-of-concept repositories are tracked for this identifier. A ProjectDiscovery Nuclei detection template exists (http/cves/2026/CVE-2026-41940.yaml). It currently carries a trending score of 60 in the Threadlinqs vulnerability feed.

ynsmroztas/cPanelSniper (github)
assetnote/cpanel2shell-scanner (github)
XsanFlip/poc-cpanel-cve-2026-41940 (github)
adriyansyah-mf/cve-2026-41940-poc (github)
ZeroDayEvil/CVE-2026-41940-PoC (github)
Sachinart/CVE-2026-41940-cpanel-0day (github)
ilmndwntr/CVE-2026-41940-MASS-EXPLOIT (github)
rfxn/cpanel-sessionscribe (github)

Affected products and versions

Cpanel: Cpanel, Whm

How to fix CVE-2026-41940

The record marks a vendor fix as available for CVE-2026-41940. Vendor advisory: https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026. Because CVE-2026-41940 is KEV-listed, US federal civilian agencies were required to apply the vendor fix, or stop using the product, by 2026-05-03. Apply the vendor fix referenced above to every affected product listed in this record, then confirm the running version against the vendor advisory.

Threat activity tracking CVE-2026-41940

9 tracked threats in the Threadlinqs corpus reference CVE-2026-41940, either in the campaign’s CVE list or as an indicator on the campaign record.

"testmetest" npm Campaign Hijacks 42 GitHub Repositories to Steal Credentials, Abuse GitHub OIDC Publishing and Spread Malware — HIGH · 2026-10-28
INC Ransomware Operators Use Claude AI and Phantom Framework; Exposed Data Shows 8,257 Messages and 46 Victim-Specific Encryptor Builds (CVE-2026-35616, CVE-2024-57727, CVE-2026-41940) — CRITICAL · 2026-10-21
INC and The Gentlemen Ransomware: Exposed AI-Executed, Human-Approved Attack Infrastructure (Phantom framework) — CRITICAL · 2026-10-20
Bitdefender Threat Debrief May 2026: KryBit vs 0APT ransomware conflict, The Gentlemen/SystemBC, and cPanel/WHM auth bypass CVE-2026-41940 — CRITICAL · 2026-10-16
CVE-2026-34486: Apache Tomcat EncryptInterceptor Bypass Actively Exploited in SnowLight and AI-Assisted Campaigns — HIGH · 2026-08-05
Compromised Packagist PHP Packages Weaponize GitHub Actions Runners to Target cPanel/WHM Servers (CVE-2026-41940) — CRITICAL · 2026-07-25
KryBit Ransomware-as-a-Service Strikes Back — Breaches 0APT Infrastructure Amid Faux-Ransomware Feud (May 2026) — HIGH · 2026-05-13
Sorry Ransomware Mass Exploitation of cPanel/WHM Authentication Bypass CVE-2026-41940 (44,000+ Servers Compromised) — CRITICAL · 2026-05-02
cPanel & WHM Missing Authentication for Critical Function (CVE-2026-41940) — CISA KEV — CRITICAL · 2026-04-30

Sources

Enriched from CVE.org, NVD, FIRST EPSS, CISA KEV, public proof-of-concept repositories, ProjectDiscovery Nuclei. Last verified by Threadlinqs on 2026-10-10. This product uses the NVD API but is not endorsed or certified by the NVD.

CVE-2026-41940 — Cpanel