PULSE
ES
FEED
ransomspacebears reclama a Alma Center Servizi Medicali S.r.l. · IT · Healthcareransomspacebears reclama a Holistic Health Group, Inc. (d/b/a Suncrafted) · US · Healthcareransomn0n reclama a Company #69 · Not Foundransomiah6477 reclama a alera · Professional Servicesransomn0n reclama a Company #68 · US · Not Foundransomn0n reclama a Company #67 · NL · Not Foundransomn0n reclama a Company #66 · Not Foundransomn0n reclama a Interior Technologies · Technologyransomeclipse reclama a Taiwan Otsuka Pharmaceutical · TW · Healthcareransomeclipse reclama a japantimes.co.jp · JP · Otherransomakira reclama a FOODMatch · Agriculture and Food Productionransomakira reclama a Shediac Lobster Shop · CA · Retail & E-Commerceransomakira reclama a Torns Enterprises · Not Foundransomkairos reclama a Oceania Digital Communications · VU · Technologyransomspacebears reclama a Alma Center Servizi Medicali S.r.l. · IT · Healthcareransomspacebears reclama a Holistic Health Group, Inc. (d/b/a Suncrafted) · US · Healthcareransomn0n reclama a Company #69 · Not Foundransomiah6477 reclama a alera · Professional Servicesransomn0n reclama a Company #68 · US · Not Foundransomn0n reclama a Company #67 · NL · Not Foundransomn0n reclama a Company #66 · Not Foundransomn0n reclama a Interior Technologies · Technologyransomeclipse reclama a Taiwan Otsuka Pharmaceutical · TW · Healthcareransomeclipse reclama a japantimes.co.jp · JP · Otherransomakira reclama a FOODMatch · Agriculture and Food Productionransomakira reclama a Shediac Lobster Shop · CA · Retail & E-Commerceransomakira reclama a Torns Enterprises · Not Foundransomkairos reclama a Oceania Digital Communications · VU · Technology
← All CVEs
CVE WatchSep 30, 2026

CVE-2026-41940

WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

CVSS

9.8

Critical

EPSS

98.5%

p100

KEV

YES

Apr 30, 2026

Exploit Today

80

0-100

Published: Apr 29, 2026 · Last modified: Sep 30, 2026 · CWE-306

EPSS · 30d
98.5%EPSS · 30 days98.5%
2026-09-162026-10-14
KEV catalog record

Product

WebPros / cPanel & WHM and WP2 (WordPress Squared)

Vulnerability

WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

Added to KEV

Apr 30, 2026

Remediate by

May 3, 2026

Known ransomware use

Yes

Summary description

WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes

https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026 ; https://docs.cpanel.net/release-notes/release-notes/ ; https://docs.wpsquared.com/changelogs/versions/changelog/#13617 ; https://nvd.nist.gov/vuln/detail/CVE-2026-41940"

Technical description

cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

Official references
Related CVEs
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-766597.5 HIG
—
———A vulnerability in the finger daemon of HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of service.11hCVE-2026-766565.3 MED
—
———A vulnerability in HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of service when traceroute is executed under certain conditions.11hCVE-2026-1108387.5 HIG
—
——0FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers can negotiate TLS-only RDP and send an input PDU without Confirm Active to inject synthetic keystrokes into the host user's X11 session via XTEST.14hCVE-2026-718548.2 HIG
—
——0OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Prior to version 2.260622.0, on a default installation, the `/api/player/**` lessons endpoints can be called without authentication, and they trust a client-supplied `userId` query parameter without verifying that the caller is that user or a member of the exercise. An unauthenticated client that knows an exercise UUID can read lessons-learned questions and answers (including each answer's author identity) and create or overwrite answers attributed to an arbitrary user. Version 2.260622.0 contains a patch.16hCVE-2026-648563.7 LOW
—
——0FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.20.0, FileRise /api/file/snippet.php does not apply the standard authenticated-session guard before processing short text preview requests. The endpoint still performs FileRise ACL checks, so normal installations do not expose an unauthenticated arbitrary file read, but unauthenticated requests can reach ACL evaluation instead of receiving an immediate 401 response. Only additional unusual proxy-header or ACL misconfiguration is documented as allowing requests to proceed into path and file-content handling. This issue is fixed in version 3.20.0.16hCVE-2026-574927.4 HIG
—
——0FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise treats an empty or missing users.txt file as a fresh installation even after setup previously completed. If storage loss, truncation, or another failure empties the user store, an unauthenticated remote caller can detect that setup mode reopened and create the next initial administrator account through the setup flow. The application lacked a durable setup-complete marker independent of the mutable user store. This issue is fixed in version 3.16.0.16h