by Kastro CVE-2026-41940
WebPros cPanel — WebPros cPanel and WHM Authentication Bypass via Login Flow
Description · from the CVE record
cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
Affected
ProductAffectedFixed inSource
cPanel11.40.0.0 – < 11.86.0.4111.86.0.41CNA
cPanel11.88.0.0 – < 11.94.0.2811.94.0.28CNA
cPanel11.96.0.0 – < 11.102.0.3911.102.0.39CNA
cPanel11.104.0.0 – < 11.110.0.9711.110.0.97CNA
cPanel11.112.0.0 – < 11.118.0.6311.118.0.63CNA
cPanel11.120.0.0 – < 11.124.0.3511.124.0.35CNA
cPanel11.126.0.0 – < 11.126.0.5411.126.0.54CNA
cPanel11.128.0.0 – < 11.130.0.1911.130.0.19CNA
cPanel11.132.0.0 – < 11.132.0.2911.132.0.29CNA
cPanel11.134.0.0 – < 11.134.0.2011.134.0.20CNA
cPanel11.136.0.0 – < 11.136.0.511.136.0.5CNA
WP Squared< 11.136.1.711.136.1.7CNA
Scores by source
VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total