Introduction
A serious security vulnerability has been discovered in cPanel and WHM, identified as CVE-2026-41940. This authentication bypass flaw allows unauthenticated attackers to gain administrative access to web hosting control panels, potentially compromising thousands of servers. Security researchers at WatchTowr Labs first disclosed the issue, highlighting the urgent need for patching.
Technical Details of the Vulnerability
The vulnerability resides in the authentication mechanism used by cPanel and WHM. By sending specially crafted requests, an attacker can bypass standard login checks and obtain a session with full administrator privileges. The flaw affects multiple versions, and proof-of-concept exploits have been publicly released.
Attack Vector
The attack is performed over the network, exploiting insecure handling of authentication tokens. No prior credentials or user interaction is required, making it particularly dangerous for exposed instances.
Impact
- Full administrative control over the cPanel/WHM interface
- Ability to modify server configurations, create accounts, and access user data
- Potential for lateral movement to other services running on the same server
Affected Versions
cPanel & WHM versions prior to the latest security release are vulnerable. Specifically, all builds before the patch issued in early 2026 are at risk. Users should check their version against the official advisory.
Remediation Steps
- Update immediately to the latest cPanel & WHM version from the official website.
- If updating is not possible, restrict access to the admin interfaces (port 2083, 2087, 2096) using a firewall or VPN.
- Monitor logs for suspicious authentication attempts and review user accounts.
Conclusion
CVE-2026-41940 is a critical vulnerability that demands prompt action. System administrators should prioritize patching and consider additional security measures. For more details, refer to the technical analysis above or the original disclosure from WatchTowr Labs.