EUVD-2026-26246Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessScan internet for exposed cPanel ports
-
DeliverySend crafted request to login endpoint
-
ExploitBypass authentication in login flow
-
ExecutionObtain privileged WHM/cPanel session
-
PersistDeploy webshell or backdoor accounts
-
ImpactPivot to hosted sites and customer data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - the description states unauthenticated remote attackers can bypass the login flow of cPanel & WHM, so any exposed instance running an unpatched build of the 11.110, 11.118, 11.126, 11.132, 11.134, or 11.136 train (or WP Squared 11.136.1 before 11.136.1.7) on its default management ports is exploitable without credentials or user interaction. The practical limiter is network reachability of the cPanel/WHM web interface (typically TCP 2082/2083/2086/2087): instances behind an IP allowlist, VPN, or jump host that blocks unsolicited internet access to those ports are not directly reachable. There is no documented requirement for a non-default configuration or specific OS platform beyond running an affected cPanel build. |
| Impact | All signals point to high real-world priority: this is confirmed actively exploited (CISA KEV), publicly available exploit code exists, EPSS sits at 16.52% (95th percentile), and SSVC technical impact is rated 'total' with automatable=yes - meaning attacks can be scripted and scaled across the internet. CVSS base score is 9.3 but the official CVSS vector string is not provided in the source data, so attack vector and privilege requirements cannot be quoted verbatim - however the description explicitly states 'unauthenticated remote attackers,' which is consistent with the high score. One apparent conflict: SSVC lists 'Exploitation: none' while CISA KEV marks the CVE as actively exploited; this likely reflects a lag in SSVC scoring rather than absence of exploitation, and defenders should trust the KEV designation. This is a top-priority issue for any organization running cPanel-managed hosting. |
| Exploit ScenarioDerived | An attacker scans the internet for exposed cPanel/WHM management ports (2082-2087) and sends a crafted HTTP request to the vulnerable login endpoint, bypassing authentication to obtain an authenticated session as a privileged account without supplying valid credentials. With publicly available exploit code and SSVC rating the attack as automatable with total technical impact, the attacker scripts mass exploitation across shared-hosting providers, then pivots to deploy webshells, exfiltrate customer data, hijack email, or inject malicious content into hosted websites. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAI
Authentication bypass in cPanel & WHM allows unauthenticated remote attackers to gain unauthorized access to the control panel by exploiting a flaw in the login flow. The vulnerability is confirmed actively exploited (CISA KEV) with publicly available exploit code, an EPSS score of 16.52% (95th percentile), and affects multiple long-term support branches of cPanel & WHM as well as WP Squared. Given that cPanel administers shared hosting environments, successful exploitation typically grants attackers control over many downstream customer sites.
RemediationAI
Apply the vendor-released patch immediately by upgrading to one of the fixed versions appropriate to your release train: cPanel & WHM 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, or 11.136.0.5, and WP Squared 11.136.1.7. Most cPanel installations are configured for automatic updates via upcp, so verify that auto-update is enabled and that the host has actually picked up the patched build (check /var/cpanel/version and the cPanel Tweak Settings update tier). Until patched, restrict network access to the cPanel/WHM management ports (2082, 2083, 2086, 2087, and the Webmail ports 2095/2096) to known administrator IPs via firewall or a reverse proxy ACL - this breaks remote login for anyone outside the allowlist, so coordinate with resellers and customer support before deploying. After patching, audit authentication logs (/usr/local/cpanel/logs/access_log, login_log) and reseller activity for signs of prior compromise given the confirmed in-the-wild exploitation, and rotate WHM root, reseller, and cPanel user credentials plus API tokens.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
cPanel & WHM is a widely deployed Linux-based web hosting control panel that provides administrators and resellers with a web UI (cPanel for end users, WHM for hosting administrators) to manage domains, email, databases, DNS, and server configuration. The root cause is CWE-306 (Missing Authentication for Critical Function), meaning the login flow fails to properly enforce authentication on a code path that should require valid credentials. WP Squared, cPanel's managed WordPress offering, shares the same vulnerable code path. Because cPanel/WHM typically runs with high privileges on shared hosting servers and exposes its management interfaces on TCP ports 2082-2087, an authentication bypass effectively grants attackers administrative control of the hosting stack.
Know when Cpanel Whm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
7DescriptionCVE.org
cPanel and WHM versions prior to 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, and 11.136.0.5 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
Articles & Coverage 8
Executive ViewAI
A critical authentication bypass in cPanel & WHM (CVE-2026-41940) is being actively exploited by threat actors according to CISA, enabling unauthorized access to hosting control panels without valid credentials. Organizations operating shared hosting face immediate risk as successful attacks compromise multiple customer environments simultaneously, creating significant breach liability and reputational damage. Urgent patching is required to prevent cascading compromise of customer accounts across all hosted services.
Apply vendor patch. If patching cannot be completed within 7 days, restrict access to cPanel login interfaces via network controls (firewall rules, WAF, VPN-gating) and enable comprehensive authentication audit logging to detect exploitation.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Vulnrichment
Exploit-DB
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.