CVE Database · CVE-2026-41940
CVSS v3.1
9.8
CVSS v4.0
9.3
EPSS
90.54%
Published
Apr 29, 2026
Modified
May 4, 2026
CISA Known Exploited Vulnerability
Added: 2026-04-30 · Due: 2026-05-03
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Public PoC / Exploit (11)
All weaponized →Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.
Description
cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeaknesses (CWE)
Affected Products (19)
References (9)