Every CVESearch/Get API key

CVE-2026-41940

WebPros cPanel and WHM Authentication Bypass via Login Flow

9.3 CriticalIn KEVPublic exploit

CVE-2026-41940 is a critical vulnerability (CVSS 9.3) in Cpanel, published April 29, 2026. CISA lists it as known to be exploited, since April 30, 2026. EUVD reports exploitation since April 30, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 98.5%, the 99th percentile. No source names a fixed version.

What does this mean?
Severity
9.3 CriticalCVSS 4.0, CVE List
Exploit chance
98.5%EPSS, 99th percentile
Exploitation
ExploitedCISA KEV,
Fixed in
No fix listedNo source names one

Description

cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

98.5%Up 82.0 points since Apr 30, 2026
90%50%10%1%

Discussion

Quiet in the last day.
14 days ago: 0 people13 days ago: 0 people12 days ago: 0 people11 days ago: 0 people10 days ago: 0 people9 days ago: 0 people8 days ago: 0 people7 days ago: 0 people6 days ago: 0 people5 days ago: 1 person4 days ago: 0 people3 days ago: 0 people2 days ago: 0 people1 day ago: 0 peopleLast 24 hours: 0 people

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitcPanel/WHM CRLF Injection Authentication Bypass RCE2026-04-28
PoC in GitHubSachinart/CVE-2026-41940-cpanel-0day2026-04-29
PoC in GitHubdebugactiveprocess/cPanel-WHM-AuthBypass-Session-Checker2026-04-29
PoC in GitHub0xabdoulaye/CPANEL-CVE-2026-419402026-04-30
PoC in GitHubAndrei-Dr/cpanel-cve-2026-41940-ioc2026-04-30
PoC in GitHubKagantua/cPanelWHM-AuthBypass2026-04-30
PoC in GitHubWesuiliye/CVE-2026-419402026-04-30
PoC in GitHubadriyansyah-mf/cve-2026-41940-poc2026-04-30
PoC in GitHubassetnote/cpanel2shell-scanner2026-04-30
PoC in GitHubilmndwntr/CVE-2026-41940-MASS-EXPLOIT2026-04-30
Show 18 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubrealawaisakbar/CVE-2026-41940-Exploit-PoC2026-04-30
PoC in GitHubrfxn/cpanel-sessionscribe2026-04-30
PoC in GitHubshahidmallaofficial/cpanel-cve-2026-41940-fix2026-04-30
PoC in GitHubzedxod/CVE-2026-41940-POC2026-04-30
PoC in GitHub0dev1337/cpanelscanner2026-05-01
PoC in GitHub0xYuR1/CVE-2026-419402026-05-01
PoC in GitHubAmirrezaMarzban/portscan-CVE-2026-419402026-05-01
PoC in GitHubJenderal92/CVE-2026-419402026-05-01
PoC in GitHubMrAriaNet/cPanel-Fix2026-05-01
PoC in GitHubNULL200OK/cve-2026-41940-tool2026-05-01
PoC in GitHubXsanFlip/poc-cpanel-cve-2026-419402026-05-01
PoC in GitHubashrafzaryouh/CVE-2026-419402026-05-01
PoC in GitHubgeorge1-adel/CVE-2026-41940_exploit2026-05-01
PoC in GitHubkmaruthisrikar/CVE-2026-41940-cPanel-Auth-Bypass-Exploit2026-05-01
PoC in GitHubmahfuzreham/cpanel-cve-2026-419402026-05-01
PoC in GitHubmerdw/cPanel-CVE-2026-41940-Scanner2026-05-01
Exploit-DBcPanel - CRLF Injection2026-05-26
NucleicPanel & WHM - Authentication Bypass via Session-File CRLF Injection

What each source reports

CVE List Score used9.3

WebPros cPanel and WHM Authentication Bypass via Login Flow

cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

Record
CVE-2026-41940
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-306
Updated
2026-11-02
EUVDEUVD-2026-262469.3

cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

Record
EUVD-2026-26246
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-85qr-8rxc-62gv9.3

cPanel and WHM versions prior to 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20,...

cPanel and WHM versions prior to 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, and 11.136.0.5 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

Record
GHSA-85qr-8rxc-62gv
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-306
Updated
2026-11-02
CISA KEVNo score

WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

Record
CVE-2026-41940
Weakness
CWE-306
Updated
2026-11-02
NVD9.3

cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

Record
CVE-2026-41940
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-306
Updated
2026-11-02

History

History
RecordedChangedSources
exploits_morePoC in GitHub
exploitsPoC in GitHub
exploits_morePoC in GitHub
exploitation
exploits, exploits_more
exploits
first indexedCVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 5 moreShow less
This page doesn't list everything

The full exploit list has 46 more links.

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open