# cPanel & WHM Missing Authentication for Critical Function (CVE-2026-41940) — CISA KEV

> WebPros cPanel & WHM and WP2 (WordPress Squared) contain a pre-authentication bypass in the login flow (CWE-306, CVE-2026-41940) that lets unauthenticated remote attackers reach administrative functions on TCP/2083 and TCP/2087. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-04-30 based on evidence of in-the-wild exploitation. Emergency vendor builds 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20 and 11.136.0.5 close the gap; large hosts including Namecheap proactively blocked the cPanel/WHM service ports while patches roll out.

- **Published:** 2026-04-30T12:00:00Z
- **Last reviewed:** 2026-04-30T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0440
- **ID:** TL-2026-0440
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-41940

## Description

CVE-2026-41940 is a missing-authentication-for-critical-function flaw in the cPanel & WHM control panel login flow that affects every supported release line beyond 11.40 and the WP2 (WordPress Squared) product that shares the cpsrvd code path. Because the cPanel & WHM administrative interface is reachable over the public internet on TCP/2083 (cPanel TLS), TCP/2087 (WHM TLS), TCP/2095 (Webmail TLS) and TCP/2096 (Webmail TLS) by default, an unauthenticated network attacker can interact with privileged endpoints normally gated by the login state machine.

The vulnerability scored CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CVSS 4.0 9.3, both Critical. CWE classification is CWE-306 — Missing Authentication for Critical Function. Successful abuse is functionally equivalent to gaining a privileged WHM session: an attacker can manage users, mailboxes, DNS, FTP, MySQL grants, and underlying server configuration, so any compromised host is best treated as fully compromised at the server-administrator layer.

CISA added CVE-2026-41940 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-04-30, citing evidence of active exploitation. The KEV listing triggers BOD 22-01 obligations for U.S. Federal Civilian Executive Branch agencies and is a strong industry signal for accelerated remediation in the broader hosting and SMB-IT ecosystem. WebPros published security update notice 40073787579671 on 2026-04-28, releasing emergency builds across all maintained release tiers (LTS 11.110, 11.118, 11.126, current 11.132/11.134/11.136). Namecheap, one of the largest cPanel-based shared-hosting operators, took the unusual step of network-blocking TCP/2083 and TCP/2087 across its fleet pending patch deployment.

This Threadlinqs record is intentionally a defensive-only knowledge base entry: it focuses on patch-state inventory, exposure reduction, and log/network telemetry blue teams can use to validate that their estate is patched and has not been touched. No exploit chain is reproduced here.

Remediation priorities are layered. First, identify every cPanel/WHM and WP2 host (managed and shadow IT) and confirm version is at or above the fixed build for its release line. Second, restrict the cPanel/WHM service ports to administrative IP allow-lists or VPN-only access until patching is verified — Namecheap-style perimeter blocks are an acceptable temporary mitigation for fleets that cannot patch within a 24-hour window. Third, perform a compromise assessment on any host that was both unpatched and internet-exposed since 2026-04-28: review /usr/local/cpanel/logs/access_log, /usr/local/cpanel/logs/error_log, /usr/local/cpanel/logs/login_log, and /var/cpanel/accounting.log for unexpected administrative logins, account creation, reseller privilege grants, package modifications, and SSH key additions. Finally, rotate WHM root, reseller, and cPanel user credentials, and reissue API tokens on any host that cannot be cleanly proven uncompromised.

## MITRE ATT&CK

- T1595 Active Scanning
- T1595.002 Active Scanning: Vulnerability Scanning
- T1592.002 Gather Victim Host Information: Software
- T1583 Acquire Infrastructure
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1136.001 Create Account: Local Account
- T1098.004 Account Manipulation: SSH Authorized Keys
- T1505.003 Server Software Component: Web Shell
- T1053.003 Scheduled Task/Job: Cron
- T1685.006 Clear Linux or Mac System Logs
- T1556 Modify Authentication Process
- T1552.001 Unsecured Credentials: Credentials In Files
- T1649 Steal or Forge Authentication Certificates
- T1082 System Information Discovery
- T1087.001 Account Discovery: Local Account
- T1021.004 Remote Services: SSH
- T1005 Data from Local System
- T1071.001 Application Layer Protocol: Web Protocols
- T1041 Exfiltration Over C2 Channel
- T1496 Resource Hijacking
- T1491.002 Defacement: External Defacement

## Sources

- [CISA Adds One Known Exploited Vulnerability to Catalog (CVE-2026-41940)](https://www.cisa.gov/news-events/alerts/2026/04/30/cisa-adds-one-known-exploited-vulnerability-catalog)
- [CISA Known Exploited Vulnerabilities Catalog — CVE-2026-41940](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41940)
- [BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities)
- [cPanel & WHM Security Update — 04/28/2026 (Article 40073787579671)](https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026)
- [cPanel & WHM Release Notes](https://docs.cpanel.net/release-notes/release-notes)
- [WP2 (WordPress Squared) Changelog — Entry 13617](https://docs.wpsquared.com/changelogs/versions/changelog/#13617)
- [Namecheap Status — Ongoing Critical Security Vulnerability in cPanel (April 28, 2026)](https://www.namecheap.com/status-updates/ongoing-critical-security-vulnerability-in-cpanel-april-28-2026)
- [VulnCheck Advisory — cPanel and WHM Authentication Bypass via Login Flow](https://www.vulncheck.com/advisories/cpanel-and-whm-authentication-bypass-via-login-flow)
- [NVD — CVE-2026-41940](https://nvd.nist.gov/vuln/detail/CVE-2026-41940)
- [MITRE CWE-306 — Missing Authentication for Critical Function](https://cwe.mitre.org/data/definitions/306.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0440