CVE-2026-41940 is a critical authentication bypass vulnerability in cPanel & WHM that allows a remote, unauthenticated attacker to gain access to the control panel. The vulnerability affects cPanel versions after 11.40 and was assigned a CVSS 3.1 score of 9.8 (Critical). CISA also added it to its Known Exploited Vulnerabilities catalog, making this an issue that administrators should treat as an active security concern rather than a theoretical vulnerability.
For a VAPT team, the vulnerability is particularly interesting because the problem isn’t a weak password or a stolen credential.
The authentication process itself could be manipulated.
What is cPanel & WHM?
cPanel & WHM is a web-based management platform commonly used to administer hosting environments. Through the interface, administrators can manage websites, domains, email, databases, files and other server functions.
That makes the administrative panel a particularly sensitive target. If someone gains unauthorized access to it, the impact can extend well beyond the panel itself.
What caused the vulnerability?
The issue was found in the way cPanel handled session information during authentication.
According to cPanel, two different parts of the software could write information to session files. One of those paths performed input sanitization before writing the information. Another path, used during Basic Authentication handling, did not apply the same protection. That inconsistency created the security problem.
An attacker could send a specially crafted request containing information that the vulnerable authentication path would process incorrectly. Under vulnerable conditions, this could result in an unauthenticated session being treated as an authenticated one.
Put simply:
No valid credentials → manipulated authentication process → authenticated session
That is the reason this became an authentication bypass rather than simply an input-validation vulnerability.
Why does it matter?
The severity comes largely from where the vulnerability exists. The affected component is the cPanel/WHM login process. An attacker who bypasses that barrier may reach administrative functionality without first obtaining legitimate credentials.
What happens after that depends on the particular server configuration and privileges, but the potential consequences include unauthorized access to hosting functions, changes to server or account configuration, access to hosted resources and further compromise of the environment.
For organizations using cPanel to manage multiple websites or services, compromising the management layer could therefore have consequences across several applications at once.
How the attack works
The underlying attack does not require an attacker to guess an administrator’s password. At a high level, the sequence looks like this:
- 01Internet-facing cPanel/WHM
- 02Attacker sends a specially crafted request
- 03Vulnerable authentication path processes the request
- 04Session information is manipulated
- 05The application incorrectly considers the session authenticated
- 06Unauthorized access to the control panel
The vulnerability was not merely theoretical. cPanel states that it received a reproducible report, confirmed the issue and began its incident response after reproducing the behavior.
For an authorized penetration test, however, reproduction should only be performed against systems explicitly included in the client’s scope.
Which versions are affected?
cPanel states that the vulnerability affects versions after 11.40. Security fixes were released across multiple branches, including 11.110, 11.118, 11.124, 11.126, 11.130, 11.132, 11.134 and 11.136.
The vendor has subsequently released newer builds as well, so checking the current cPanel security guidance is preferable to relying on the original April 2026 version list.
What should organizations do?
Patch first. cPanel’s primary recommendation is to update affected installations to a patched release.
If an immediate update isn’t possible, cPanel provides temporary mitigation options, including restricting access to relevant cPanel service ports and disabling affected services where appropriate. These measures should be considered temporary; patching remains the preferred solution.
There is another important step: check whether the server may already have been compromised. Because the vulnerability has been exploited, updating an affected server should not automatically be treated as the end of the investigation. cPanel published a detection script designed to look for indicators associated with exploitation and recommends scanning systems that were unpatched during the incident window.
Security teams should also review administrator activity, unexpected account changes, suspicious sessions, modified files and other signs of unauthorized access.
What VAPT teams can learn from CVE-2026-41940
This vulnerability is a good example of why web application testing cannot stop at checking for SQL injections, XSS and other familiar vulnerabilities. Authentication is one of the application’s most important security boundaries. If that boundary can be bypassed, an attacker may gain access to functionality that was never supposed to be available to them in the first place.
When assessing an administrative web application, testers should therefore look at the complete authentication flow:
Authentication → Session Management → Authorization → Privileged Functions
A weakness at the beginning of that chain can make the protections later in the chain much less useful.
Where Depth Defense fits in
At Depth Defense, this is the type of issue that demonstrates why VAPT needs to go beyond automated scanning. A scanner might identify an outdated cPanel installation. That is useful, but it is only the beginning. A proper assessment should establish whether the affected service is exposed, determine the potential impact, validate the vulnerability within the agreed scope and explain what an attacker could realistically achieve.
The same principle applies when testing web applications, APIs, mobile applications, cloud environments and network infrastructure. The goal isn’t simply to give a client a long list of CVE numbers. The goal is to understand which weaknesses matter, how they could be abused and what needs to be fixed first.
For organizations in Saudi Arabia, that approach can make the difference between a VAPT report that sits in a ticketing system and one that helps the security and development teams reduce their exposure.
The technical details above are supported by NVD and cPanel’s own security disclosures.