cPanel Authentication Bypass (CVE-2026-41940): Patch and Protect

What is CVE-2026-41940?

CVE-2026-41940 is a critical authentication bypass in cPanel, WHM and WP Squared. A remote attacker who sends specially made requests may get access to WHM as any user, without a password. Because WHM controls the whole server, this is a very high risk.

Which versions are affected?

Product	Affected versions	Fixed versions (minimum)
cPanel & WHM	All versions after 11.40	11.86.0.41, 11.110.0.97, 11.118.0.63, 11.124.0.35, 11.126.0.54, 11.130.0.19, 11.132.0.29, 11.134.0.20, 11.136.0.5
WP Squared	All versions before 11.136.1.7	11.136.1.7 and later

This affects shared servers, VPS, dedicated servers and cloud instances (AWS, Google Cloud, Azure) that run cPanel and WHM. Treat a server as affected until you confirm its version.

Note: Always compare with the official cPanel security notice for the latest list of fixed builds.

What can happen if you do not patch

An attacker can enter WHM without any credentials.
They can read private data, create accounts, change settings and plant malware.
The flaw can be tested against any public cPanel or WHM address.

Check if you are affected

In WHM

Log in to WHM.
Go to Home, then Server Configuration, then Server Information.
Read the cPanel & WHM version line and compare it to the fixed versions above.

From the command line

Connect by SSH and run:

/usr/local/cpanel/cpanel -V

or:

cat /usr/local/cpanel/version

If your version is newer than 11.40 and not in the fixed list, update.

Fix it

In WHM

Log in to WHM as root.
Go to Home, then Update Tools, then Upgrade to Latest Version.
Start the upgrade and wait until it finishes.
Check the new version in Server Information.

From the command line

As root, run:

/usr/local/cpanel/scripts/upcp --force

Then check the version:

/usr/local/cpanel/cpanel -V

Test the WHM login, and look in /var/log/cpanel/install.log for errors. Restart the service if needed:

systemctl restart cpanel

If you cannot patch right now

These steps limit the risk but do not fix the flaw:

Allow WHM (port 2087) and cPanel (port 2083) only from trusted IP addresses. With CSF:

csf -a YOUR_TRUSTED_IP "Trusted Admin"

Block ports 2083, 2087, 2095 and 2096 for everyone else.
Ask admins to use a VPN, and do not expose WHM to the public internet.
Check which ports listen with ss -tlnp. Close what you do not need.
Watch /var/log/cpanel/ and the auth logs for odd logins.

After the update

Confirm the patched version in WHM and on the command line.
Read the logs around the time of the update for odd logins.
Look for unknown WHM, root or reseller accounts.
Change the root, WHM and cPanel passwords. Renew SSH keys if you have doubts.
Look for cron jobs or services that you did not add.
Check that only the needed ports and addresses are allowed.

Harden your server

Turn on two-factor authentication for all admin logins.
Limit WHM and cPanel access to known IP addresses.
Turn on automatic updates.
Keep backups off the server.
Use logging and an intrusion detection system.

If you run cPanel on a Hostvento server and need help, open a support ticket.

Quick recap

The flaw lets attackers bypass the login of cPanel and WHM.
Update to a fixed version with upcp --force.
Restrict access to the cPanel ports until you patch.