Brief Summary: CVE-2026-41940 — Critical Authentication Bypass in cPanel and WHM Login Flow

Introduction

An authentication bypass in cPanel and WHM's login flow, disclosed on April 28, 2026, allows unauthenticated remote attackers to walk straight into the control panel without credentials. cPanel is estimated to power anywhere from 22 percent to over 94 percent of the web hosting control panel market, so the exposure is hard to overstate. This one vulnerability could grant administrative access to the infrastructure behind millions of hosted websites, databases, and mail servers.

CVE-2026-41940 has a CVSS 3.1 base score of 9.8 and a CVSS 4.0 score of 9.3. The industry response was immediate. Namecheap, one of the largest hosting providers, declared an emergency maintenance event and proactively blocked control panel ports across their infrastructure while patches were applied.

Technical Information

Root Cause: Missing Authentication for Critical Function (CWE-306)

CVE-2026-41940 is classified as CWE-306, Missing Authentication for Critical Function. The root cause is in the login flow of both cPanel and WHM. Vendor changelogs track the underlying issue as internal identifier CPANEL-52908 and describe it as improper session loading and saving. The WP Squared release notes independently confirm that CPANEL-52908 addresses an issue with login authentication.

The authentication paths in the control panel contained a logic error that let session state be manipulated so that standard credential verification was skipped. The vendor's advisory places the flaw in "various authentication paths" within the control panel. That suggests the bug sits in the shared session-handling logic used by multiple login interfaces, rather than in a single endpoint.

Attack Vector and Exploitation Flow

The attack surface is the network interfaces used for control panel access:

• TCP port 2083: cPanel user interface
• TCP port 2087: WHM (Web Host Manager) administrative interface

Based on available intelligence, exploitation works like this:

1. The attacker finds a cPanel or WHM instance exposed on port 2083 or 2087. These are standard ports and easy to discover with network scanning.

2. The attacker sends specially crafted requests to the login endpoints on these ports. No valid credentials are required.

3. The crafted requests exploit the improper session loading and saving. The logic error in the authentication paths lets the attacker establish or hijack a session without completing normal credential verification.

4. With a valid session established through the bypass, the attacker has unauthorized access to the control panel with that session's privileges. This can include full administrative access to WHM, which controls every hosted account on the server.

The attack needs no prior authentication and no user interaction, and it can be executed remotely over the network. That combination is what drives the near-maximum CVSS score.

Scope of Impact

Successful exploitation gives an attacker the full capabilities of the control panel. Through cPanel and WHM, that includes the ability to:

• create, modify, or delete hosting accounts
• access and modify all hosted websites and databases
• read and send email through hosted mail accounts
• modify DNS records
• install software
• execute commands on the underlying server

A compromised WHM instance effectively means full server compromise.

Patch Information

On April 28, 2026, cPanel issued an emergency security update for CVE-2026-41940 on all six active release branches at once. Because cPanel is proprietary software, there is no public source code commit or diff. The fix ships as updated proprietary builds through cPanel's own update mechanism.

The patched builds remove the authentication-path logic error that let unauthenticated remote attackers bypass the login flow. The following table lists the minimum safe version for each release branch:

WP Squared, a cPanel-derived product, is also affected. Versions below 11.136.1.7 need an update.

To apply the fix, administrators should run the forced update command on the server:

/scripts/upcp --force

This immediately pulls the latest patched build for whichever release branch the server is tracking. There is no selective or granular patch. The entire cPanel and WHM package is updated to the fixed build number.

Important caveat: Servers running unsupported (end-of-life) cPanel versions will not receive this update through the normal channel, and they are very likely vulnerable too. For those environments, the only path to remediation is upgrading to a supported branch.

If immediate patching is not feasible, organizations should block external access to TCP ports 2083 and 2087 with strict firewall rules. Major hosting providers, including Namecheap, used this exact workaround during their emergency maintenance windows to prevent exploitation until patches were fully deployed. It temporarily restricts access to the control panel interfaces, but it effectively neutralizes the remote attack vector.

Affected Systems and Versions

The following cPanel and WHM versions are confirmed vulnerable:

• cPanel and WHM 11.110: All versions prior to 11.110.0.97
• cPanel and WHM 11.118: All versions prior to 11.118.0.63
• cPanel and WHM 11.126: All versions prior to 11.126.0.54
• cPanel and WHM 11.132: All versions prior to 11.132.0.29
• cPanel and WHM 11.134: All versions prior to 11.134.0.20
• cPanel and WHM 11.136: All versions prior to 11.136.0.5
• WP Squared 11.136: All versions prior to 11.136.1.7

Servers running end-of-life cPanel versions that are no longer in the supported release train are also very likely vulnerable, but they will not receive patches through the standard update mechanism.

The vulnerable interfaces are the cPanel web interface on TCP port 2083 and the WHM administrative interface on TCP port 2087.

Vendor Security History

cPanel patches security issues frequently. Recent changelogs record quick fixes for Insecure Direct Object Reference flaws and cross-site scripting vulnerabilities, along with updates to bundled third-party components such as Roundcube and PHP. The same-day release of patches across six active branches for CVE-2026-41940 is consistent with that track record. The internal tracking identifier CPANEL-52908 appears in both the official cPanel changelogs and the WP Squared release notes, which points to coordinated disclosure and remediation across derived products.

References

• NVD: CVE-2026-41940
• cPanel and WHM Security Update 04/28/2026
• VulnCheck Advisory: cPanel and WHM Authentication Bypass via Login Flow
• cPanel and WHM Release Notes
• cPanel 134 Change Log
• WP Squared Changelog
• Namecheap Status: Critical Security Vulnerability in cPanel, April 28, 2026
• watchTowr Rapid Reaction: cPanel Authentication Bypass