CVE-2026-41940: cPanel, WHM and WP Squared auth bypass

THREAT INTELLIGENCE

Peer Review

4.8

Proven Trust

Dark blue circle with two overlapping checkmarks, one green and one light blue.

ISO 27001 text with a globe outline symbol on a black background.

2025 winner badge for Cyber Security Excellence Awards with gold and black design.

CVE-2026-41940

Other

May 5, 2026

Executive Summary

CVE-2026-41940 allows unauthenticated attackers to gain full administrative access and remote code execution. Active exploitation and ransomware observed.

Key Details

Affected Platform

Attack Surface

Recommended Action

Affected Environment

Internet-facing WHM, cPanel, and WP Squared instances on Linux hosting infrastructure are exposed. Around 1.5M cPanel systems appear online.

Operational Impact

An attacker can control the cPanel host, its configuration, databases, and managed websites. Observed impact includes server compromise and Linux encryptor deployment.

Technical Root Cause

A login-flow bug in cpsrvd lets attackers craft session files by abusing cookie handling and header injection. This bypasses normal authentication checks.

Recommended Mitigation

Promptly apply vendor patches for all affected cPanel, WHM, and WP Squared versions after testing.
Strengthen vulnerability and patch management processes.

Concerned about your exposure?

Our security experts can help you assess affected systems, validate risk and support a safe remediation plan.

Discuss Your Security Exposure Explore Managed Detection and Response

Assess your risk

Identify affected systems

Plan remediation

Practical, vendor-aligned guidance

Get expert support

From our 24/7 security team

Stay ahead of emerging threats

Get the latest threat intelligence and security advisories from Smarttech247.

Full Technical Report

Download the complete analysis, including detailed technical findings and references.

Download Full Report (PDF)

References

Use vendor guidance and trusted analyses to validate exposure and fixes. Key sources include cPanel advisories, CISA KEV, and technical write-ups on CVE-2026-41940.