Improper authentication in cPanel - CVE-2026-41940
Published: April 30, 2026 / Updated: June 23, 2026
Vulnerability identifier: #VU128557
CSH Severity: Critical
CVSS v4: 10 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H]
CVE-ID: CVE-2026-41940
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to an error in the authentication process. A remote non-authenticated attacker can bypass authentication process and gain unauthorized access to the application.
Successful exploitation of the vulnerability may result in full system compromise.
Note, the vulnerability is being actively exploited in the wild.
Affected software
cPanel
How to mitigate CVE-2026-41940
Install updates from vendor's website.
cPanel - addressed in versions 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, 11.136.0.5
Links to Public Exploits and PoC-codes
- Exploit #12772 - CVE-2026-41940-PoC (CVE-2026-41940 exploitation proof-of-concept project) (June 23, 2026)
- Exploit #12728 - CVE-2026-41940-cPanel-Auth-Bypass-Exploit () (May 22, 2026)
- Exploit #12713 - cPanel/WHM CRLF Injection Authentication Bypass RCE (May 18, 2026)
- Exploit #12710 - cve202641940 (bir cve için egitim amaçlı exploit ) (May 15, 2026)
- Exploit #12708 - CVE-2026-41940-PoC-Exploit (? CVE-2026-41940 cPanel/WHM Auth Bypass Exploit - Best Flow ? CRLF injection leads to auth bypass, session hijacking & account leak. ✅ Proxy, custom UA, keep-alive, retries, SSL verify, colored output, file save support. ⚡ Adva (May 15, 2026)
- Exploit #12681 - cPanel-WHM-AuthBypass-Session-Checker (Post-Exploitation Session Validation Tool for CVE-2026-41940) (April 30, 2026)
- Exploit #12680 - CVE-2026-41940-Exploit-PoC (This repository contains a Proof-of-Concept (PoC) exploit for CVE-2026-41940, a critical authentication bypass vulnerability in cPanel & WHM. The vulnerability allows unauthenticated remote attackers to gain unauthorized access (April 30, 2026)
- Exploit #12679 - CVE-2026-41940-MASS-EXPLOIT (CVE-2026-41940 SUPPORT SINGLE & MASS SCAN EXPLOIT) (April 30, 2026)