{"id":5611,"date":"2026-04-30T23:56:10","date_gmt":"2026-05-01T03:56:10","guid":{"rendered":"https:\/\/underhost.com\/blog\/?p=5611"},"modified":"2026-05-01T15:13:02","modified_gmt":"2026-05-01T19:13:02","slug":"critical-cpanel-authentication-bypass-patch-now-cve-2026-41940","status":"publish","type":"post","link":"https:\/\/underhost.com\/blog\/critical-cpanel-authentication-bypass-patch-now-cve-2026-41940\/","title":{"rendered":"Critical cPanel Authentication Bypass – Patch Now (CVE-2026-41940)"},"content":{"rendered":"
\n
Security Advisory \u00b7 CVE-2026-41940<\/div>\n

CVE-2026-41940 affects cPanel & WHM versions after 11.40 – Update to patched releases immediately<\/h2>\n

UnderHost is releasing this urgent security guidance for server administrators, resellers, and self-managed VPS\/dedicated customers. A remote authentication flaw can allow attackers to bypass login controls. Patch versions are available – action required now.<\/p>\n<\/div>\n

<\/p>\n

Critical severity – Authentication bypass in cPanel & WHM (CVE-2026-41940).<\/strong>
\nAll versions after 11.40 are vulnerable unless patched. UnderHost provides patched version numbers, firewall mitigations, a detection script, and immediate update instructions. Update before May 5, 2026, to avoid potential compromise.<\/strong><\/div>\n
\n
\n

<\/i> What is CVE-2026-41940?<\/h2>\n

CVE-2026-41940 is an authentication bypass vulnerability<\/strong> discovered in cPanel & WHM (including DNSOnly). It affects all versions released after cPanel 11.40. An attacker can exploit this flaw to bypass authentication mechanisms, potentially gaining unauthorized access to WHM, cPanel accounts, and sensitive server functions. No public exploit is required – the vulnerability can be triggered remotely over ports 2083, 2087, 2095, and 2096.<\/p>\n

Official advisory:<\/strong>
\n
\ncPanel Security CVE-2026-41940 \u2013 WP2 Security Update (04\/28\/2026)
\n<\/a><\/p>\n