CVE-2026-41940

This flaw lets an attacker skip the normal “prove who you are” step when logging into your hosting control panel. Think of it like someone getting into your building because the door lock can be tricked during the entry check—once inside, they can move around and control what they shouldn’t.

Because it affects the login process for cPanel/WHM, a successful attack can lead to serious damage to your websites and server configuration.

This matters if you run cPanel/WHM for your business hosting (including any setup that includes WHM or cPanel web access) because the login flow can be bypassed to gain unauthorized access. It can also affect “WP Squared” installations associated with your environment.

Treat it as a risk when the vulnerable web login endpoints are reachable over the network from where attackers can reach them; cPanel/WHM login is designed for remote access, so exposed systems are the ones most likely to be targeted. CISA KEV indicates attackers have used this in ransomware campaigns.

This is RED because it’s already been used in ransomware campaigns and is listed in CISA KEV. That means the real-world attack path is known and actively abused.

Patch as fast as possible because the weakness is a login bypass—once attackers can reach the login flow, they don’t need stolen passwords or user interaction.