Missing authentication in cPanel & WHM (CVE-2026-41940) — control-panel takeover without authentication, ransomware use confirmed

1cPanel & WHM as hosting management

CVE-2026-41940 is a missing-authentication-for-a-critical-function vulnerability (CWE-306) in WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared). It was added to CISA's KEV catalog on April 30, 2026, with ransomware use also confirmed.

2An authentication bypass in the login flow

Per NVD, an authentication bypass in the login flow lets an unauthenticated remote attacker gain unauthorized access to the control panel. cPanel & WHM is one of the most widely used control panels in the hosting industry, centrally managing sites, email, databases, and domains on a web server.

Seizing it without authentication lets an attacker manipulate the many websites and data on that server, so damage can escalate rapidly.

3Ransomware exploitation also confirmed

CISA has also confirmed exploitation in ransomware campaigns, making priority high. In setups like shared hosting, where a single server hosts many customer sites, compromising the control panel can lead to cascading damage.

4One control panel connects to many customers

cPanel & WHM is the control panel managing sites, mail, databases and domains on a web server in one place. In shared hosting, that one machine holds many customers.

1. 1Reach the control panel without authenticationThe login flow carries an authentication bypass
2. 2Reach every site on the serverSites, mail, databases and domains are managed from one place
3. 3Propagate to many customersIn a configuration where one server holds many customer sites, damage cascades

CISA also confirms exploitation in ransomware campaigns, which raises the priority. Minimising internet exposure of the control panel and enforcing multi-factor authentication are effective too. The remediation date for federal civilian agencies is 3 May 2026, a short window.