CVE-2026-41940 exploitation pushes cPanel and WHM remediation

**cPanel and WHM** are affected by **CVE-2026-41940**, an **authentication bypass** in the login flow that can let **unauthenticated remote attackers** gain control-panel access. The flaw is rated **9.8/10.0**, has a **patch available**, and was reported as **actively exploited as a 0-day**, raising immediate risk for exposed servers. cPanel has pushed fixes across supported versions and urged operators to update right away.

Active exploitation of **CVE-2026-41940** is driving a **large cPanel & WHM compromise wave**, putting exposed servers at risk of administrative takeover. **More than 40,000 servers** have likely been compromised, showing that the attack has moved well beyond isolated probing. The flaw can hand unauthenticated attackers **admin access**, letting them control managed sites, databases, and configurations.

A **previously unknown threat actor** ran a **cPanel authentication-bypass campaign** that combined public exploit code and custom access tooling to reach government, military, MSP, and hosting targets across Southeast Asia and beyond. The activity mattered because it paired **initial access**, **persistence**, and **internal pivoting**, raising the risk of follow-on compromise and collection. The same access layer was later used to exfiltrate **Chinese railway-sector documents** from an internal network.

**WebPros International** released an **emergency update** for **cPanel** and **WHM** after a critical **authentication-bypass** flaw could expose supported installations to **unauthorized control-panel access**. The bulletin covers patched releases for the affected hosting software and directs administrators to run **/scripts/upcp –force** to retrieve the safe version. Because these tools are widely deployed for server and website management, prompt installation is important on internet-facing systems.

cPanel issued mitigation guidance for **CVE-2026-41940** after fixes became available for **cPanel, WHM, and WP Squared**, urging customers to restart **cpsrvd** to reduce exposure. If patching is not immediately possible, operators should block external access to **2083**, **2087**, **2095**, and **2096**, or stop the **cpsrvd** and **cpdavd** core services. The vendor also provided a detection script and recommended purging sessions, resetting credentials, auditing logs, and checking for persistence if compromise indicators appear.

**cPanel** released **security updates** for **cPanel and WHM** after an **authentication bypass** flaw could let remote attackers reach control-panel access, with fixes now covering multiple supported builds and **WP Squared 136.1.7**. The update set spans several named releases, and cPanel told operators of unsupported versions to move to a supported build as soon as possible. Administrators were also told to apply the patch immediately, while temporary mitigations blocked **2083/2087/2095/2096** or stopped **cpsrvd** and **cpdavd** until deployment.