CRITICALCVSS 9.3KNOWN EXPLOITEDRANSOMWARE: KNOWN

CVE-2026-41940

CVE-2026-41940 updated by NVD

Published: 2026-04-30
Modified: 2026-11-04
Sources: cisa-kev, nvd

Summary

cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
WordPress	wp_squared	[object Object]	—

References

https://nvd.nist.gov/vuln/detail/CVE-2026-41940

Includes data from the CISA Known Exploited Vulnerabilities catalog.

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.