cPanel & WHM Missing Authentication for Critical Function (CVE-2026-41940) — CISA KEV

cPanel & WHM Missing Authentication for Critical Function (TL-2026-0440), also tracked as cPanel WHM AuthBypass 2026, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-04-30. It has no confirmed attribution, affects WebPros cPanel & WHM, references 1 CVE (CVE-2026-41940), maps to 24 MITRE ATT&CK techniques (T1005, T1021.004, T1041), and is covered by 9 detection rules and 18 indicators of compromise.

Key facts for TL-2026-0440

Threat ID
TL-2026-0440
Also known as
cPanel WHM AuthBypass 2026, WebPros Login Flow Auth Bypass, cPanel Pre-Auth Bypass (Apr 2026)
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-04-30
Last reviewed
2026-04-30
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
hosting, small-business, education, government, media, ecommerce, nonprofit, healthcare, professional-services
Target regions
Global, North America, Europe, Asia-Pacific, Latin America
Detection rules
9
Indicators of compromise
18

WebPros cPanel & WHM and WP2 (WordPress Squared) contain a pre-authentication bypass in the login flow (CWE-306, CVE-2026-41940) that lets unauthenticated remote attackers reach administrative functions on TCP/2083 and TCP/2087. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-04-30 based on evidence of in-the-wild exploitation. Emergency vendor builds 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20 and 11.136.0.5 close the gap; large hosts including Namecheap proactively blocked the cPanel/WHM service ports while patches roll out.

How cPanel & WHM Missing Authentication for Critical Function works

CVE-2026-41940 is a missing-authentication-for-critical-function flaw in the cPanel & WHM control panel login flow that affects every supported release line beyond 11.40 and the WP2 (WordPress Squared) product that shares the cpsrvd code path. Because the cPanel & WHM administrative interface is reachable over the public internet on TCP/2083 (cPanel TLS), TCP/2087 (WHM TLS), TCP/2095 (Webmail TLS) and TCP/2096 (Webmail TLS) by default, an unauthenticated network attacker can interact with privileged endpoints normally gated by the login state machine.

The vulnerability scored CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CVSS 4.0 9.3, both Critical. CWE classification is CWE-306 — Missing Authentication for Critical Function. Successful abuse is functionally equivalent to gaining a privileged WHM session: an attacker can manage users, mailboxes, DNS, FTP, MySQL grants, and underlying server configuration, so any compromised host is best treated as fully compromised at the server-administrator layer.

CISA added CVE-2026-41940 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-04-30, citing evidence of active exploitation. The KEV listing triggers BOD 22-01 obligations for U.S. Federal Civilian Executive Branch agencies and is a strong industry signal for accelerated remediation in the broader hosting and SMB-IT ecosystem. WebPros published security update notice 40073787579671 on 2026-04-28, releasing emergency builds across all maintained release tiers (LTS 11.110, 11.118, 11.126, current 11.132/11.134/11.136). Namecheap, one of the largest cPanel-based shared-hosting operators, took the unusual step of network-blocking TCP/2083 and TCP/2087 across its fleet pending patch deployment.

This Threadlinqs record is intentionally a defensive-only knowledge base entry: it focuses on patch-state inventory, exposure reduction, and log/network telemetry blue teams can use to validate that their estate is patched and has not been touched. No exploit chain is reproduced here.

Remediation priorities are layered. First, identify every cPanel/WHM and WP2 host (managed and shadow IT) and confirm version is at or above the fixed build for its release line. Second, restrict the cPanel/WHM service ports to administrative IP allow-lists or VPN-only access until patching is verified — Namecheap-style perimeter blocks are an acceptable temporary mitigation for fleets that cannot patch within a 24-hour window. Third, perform a compromise assessment on any host that was both unpatched and internet-exposed since 2026-04-28: review /usr/local/cpanel/logs/access_log, /usr/local/cpanel/logs/error_log, /usr/local/cpanel/logs/login_log, and /var/cpanel/accounting.log for unexpected administrative logins, account creation, reseller privilege grants, package modifications, and SSH key additions. Finally, rotate WHM root, reseller, and cPanel user credentials, and reissue API tokens on any host that cannot be cleanly proven uncompromised.

MITRE ATT&CK techniques used in TL-2026-0440

Collection

T1005 Data from Local System

Lateral Movement

T1021.004 Remote Services: SSH

Exfiltration

T1041 Exfiltration Over C2 Channel

Persistence

T1053.003 Scheduled Task/Job: Cron; T1098.004 Account Manipulation: SSH Authorized Keys; T1136.001 Create Account: Local Account; T1505.003 Server Software Component: Web Shell

Execution

T1059 Command and Scripting Interpreter

Command and Control

T1071.001 Application Layer Protocol: Web Protocols

Initial Access

T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application

Discovery

T1082 System Information Discovery; T1087.001 Account Discovery: Local Account

Impact

T1491.002 Defacement: External Defacement; T1496 Resource Hijacking

Credential Access

T1552.001 Unsecured Credentials: Credentials In Files; T1649 Steal or Forge Authentication Certificates

defense-impairment

T1556 Modify Authentication Process; T1685.006 Clear Linux or Mac System Logs

Resource Development

T1583 Acquire Infrastructure

Reconnaissance

T1592.002 Gather Victim Host Information: Software; T1595 Active Scanning; T1595.002 Active Scanning: Vulnerability Scanning

Affected products and versions in cPanel & WHM Missing Authentication for Critical Function

  • WebPros — cPanel & WHM
    Vulnerable versions: all releases after 11.40 prior to 11.110.0.97; 11.118 series prior to 11.118.0.63; 11.126 series prior to 11.126.0.54; 11.132 series prior to 11.132.0.29; 11.134 series prior to 11.134.0.20; 11.136 series prior to 11.136.0.5
    Fixed in: 11.110.0.97; 11.118.0.63; 11.126.0.54; 11.132.0.29; 11.134.0.20; 11.136.0.5
  • WebPros — WP2 (WordPress Squared)
    Vulnerable versions: releases prior to the security update referenced in WP2 changelog entry 13617
    Fixed in: WP2 build referenced in changelog entry 13617

Remediation for cPanel & WHM Missing Authentication for Critical Function

Patches

  • WebPros cPanel & WHM 11.110.0.97 (legacy LTS)
  • WebPros cPanel & WHM 11.118.0.63 (LTS)
  • WebPros cPanel & WHM 11.126.0.54 (stable)
  • WebPros cPanel & WHM 11.132.0.29 (current)
  • WebPros cPanel & WHM 11.134.0.20 (current)
  • WebPros cPanel & WHM 11.136.0.5 (current)
  • WebPros WP2 (WordPress Squared) — apply security update referenced in the WP2 changelog entry 13617

Immediate actions

  • Inventory all cPanel & WHM and WP2 (WordPress Squared) hosts across owned and managed estate; flag any host whose version is below the fixed build for its release line.
  • Block inbound traffic to TCP/2083 (cPanel TLS), TCP/2087 (WHM TLS), TCP/2095 and TCP/2096 (Webmail TLS) at the perimeter for any host that cannot be patched within 24 hours; restrict to admin-jump-host or VPN source IPs only.
  • Apply WebPros emergency builds: 11.110.0.97 (LTS), 11.118.0.63 (LTS), 11.126.0.54, 11.132.0.29, 11.134.0.20, 11.136.0.5 (current). Run upcp --force on each host and verify build with /usr/local/cpanel/cpanel -V.
  • Pull /usr/local/cpanel/logs/access_log, login_log, error_log and /var/cpanel/accounting.log for the window 2026-04-28 to present and search for unauthenticated administrative actions, unexpected account creation, reseller privilege grants and SSH key additions.
  • Rotate WHM root password, all reseller passwords, all cPanel user passwords, and revoke/reissue every WHM and cPanel API token on hosts that were both unpatched and internet-exposed in that window.

Workarounds

  • Network-block TCP/2083 and TCP/2087 (and TCP/2086, TCP/2095, TCP/2096 if exposed) at upstream firewall, edge ACL, or cloud security group until the host is patched.
  • Restrict cPanel & WHM ports with the host firewall (cphulkd, csf or iptables) to a small admin allow-list of management IPs.
  • Place cPanel/WHM behind an authenticating reverse proxy that enforces mTLS or SSO before traffic reaches cpsrvd.
  • Where supported, enable WHM Security Advisor's 'restrict UI access by IP' control.

Longer-term hardening

  • Move cPanel/WHM administrative ports behind a VPN, bastion, or zero-trust proxy; expose only TCP/443 reverse-proxied with an authenticating WAF when remote admin is required.
  • Subscribe to the cPanel Security Advisory mailing list and ingest the WebPros release-notes feed into the patch SLA pipeline so KEV-tier flaws are noticed within 1 business day.
  • Enable cPanel's two-factor authentication (Security Center > Two-Factor Authentication) for WHM, reseller and cPanel users as a defense-in-depth layer against credential abuse.
  • Stand up FIM (file integrity monitoring) on /usr/local/cpanel, /var/cpanel, /etc/userdomains, /etc/passwd, /root/.ssh and /home/*/.ssh so post-exploit persistence (cron, SSH keys, reseller adds) generates alerts.
  • Forward cpsrvd, cphulkd, dovecot, exim and pure-ftpd logs to a central SIEM with at-least-daily review for anomalous admin-portal activity.

CVEs associated with cPanel & WHM Missing Authentication for Critical Function

CVE-2026-41940

Weaknesses (CWE) in cPanel & WHM Missing Authentication for Critical Function

CWE-306

Timeline of cPanel & WHM Missing Authentication for Critical Function

  • WP2 (WordPress Squared) publishes the security update referenced in changelog entry 13617, fixing the same login-flow auth bypass on the shared cpsrvd code path.
  • Namecheap publishes status update and proactively blocks TCP/2083 and TCP/2087 across its hosting fleet pending patch deployment.
  • WebPros publishes cPanel & WHM Security Update 04-28-2026 (support article 40073787579671) and emergency builds 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20 and 11.136.0.5 across all maintained release tiers.
  • Public proof-of-concept tooling appears at github.com/watchtowrlabs/watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py, raising the urgency for blue teams to validate patch state and exposure.
  • VulnCheck reserves and discloses CVE-2026-41940 with CVSS 3.1 9.8 / CVSS 4.0 9.3 and CWE-306 classification; NVD publishes the record at 16:16 UTC.
  • Threadlinqs Intelligence opens TL-2026-0440 as a defensive-only knowledge-base entry; research focuses on patch-state inventory, exposure reduction, and detection telemetry.
  • CISA adds CVE-2026-41940 to the Known Exploited Vulnerabilities catalog citing evidence of active exploitation, triggering BOD 22-01 obligations for U.S. FCEB agencies.
  • As of 2026-05-29, CVE-2026-41940 (cPanel/WHM pre-auth bypass) remains under heavy multi-actor mass exploitation despite the Apr 28 patch and CISA KEV listing. Shadowserver saw ~44K attacking IPs against ~650K-1.5M exposed instances, with .sorry ransomware and Filemanager backdoors deployed in the wild.

Sources cited for cPanel & WHM Missing Authentication for Critical Function

Threats related to cPanel & WHM Missing Authentication for Critical Function

Detection coverage for TL-2026-0440

As of 2026-04-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0440 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats