Dashboard / CVE-2026-41940

CVE-2026-41940

CRITICAL CISA KEV RANSOMWARE
ACT NOW Priority: 9.16 BB Relevance: 89/100
Published: 2026-04-29 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: X
AT: None
VC: High
VI: High
VA: High

Description

WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

CISA Known Exploited Vulnerability

Vendor / Product WebPros — cPanel & WHM and WP2 (WordPress Squared)
Date Added 2026-04-30
Remediation Due 2026-05-03
Ransomware Use CONFIRMED
https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026 ; https://docs.cpanel.net/release-notes/release-notes/ ; https://docs.wpsquared.com/changelogs/versions/changelog/#13617 ; https://nvd.nist.gov/vuln/detail/CVE-2026-41940"

Weakness Classification (1)

Affected Software (19)

VendorProductVersion
cpanel cpanel 11.40 – 86.0.41
cpanel cpanel 88.0.0 – 110.0.97
cpanel cpanel 112.0.0 – 118.0.63
cpanel cpanel 120.0.0 – 124.0.35
cpanel cpanel 126.0.1 – 126.0.54
cpanel cpanel 128.0.0 – 130.0.19
cpanel cpanel 132.0.0 – 132.0.29
cpanel cpanel 134.0.0 – 134.0.20
cpanel cpanel 136.0.0 – 136.0.5
cpanel whm 11.40 – 86.0.41
cpanel whm 88.0.0 – 110.0.97
cpanel whm 112.0.0 – 118.0.63
cpanel whm 120.0.0 – 124.0.35
cpanel whm 126.0.1 – 126.0.54
cpanel whm 128.0.0 – 130.0.19
cpanel whm 132.0.0 – 132.0.29
cpanel whm 134.0.0 – 134.0.20
cpanel whm 136.0.0 – 136.0.5
cpanel wp_squared < 136.1.7

References & Advisories (9)

Bug Bounty Relevance

89 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction
✓ Known exploited (KEV)
✓ High exploitation probability

CVSS Score

9.3 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

98.53%
Raw Score 0.985270
Percentile 99.9%
Date 2026-10-28

Intelligence Sources

kev ref →
nvd ref →

External Links