On April 28, 2026, cPanel disclosed CVE-2026-41940 — a critical authentication bypass affecting nearly every cPanel/WHM version ever shipped, with exploits already in the wild. Hosting providers worldwide blocked ports 2082–2096 within the hour. Here’s the full technical breakdown, the timeline, and what to do if you haven’t patched.
CVE-2026-41940 is a critical, unauthenticated authentication bypass in cPanel/WHM affecting all versions after 11.40 — including end-of-life releases. Exploits were seen in the wild before the patch existed, and providers like KnownHost, Namecheap, and HostPapa blocked ports 2082/2083/2086/2087/2095/2096 within an hour. If you run cPanel: update to a patched build (11.86.0.41+ through 11.136.0.5+), audit access logs for the disclosure window, rotate every credential, and hunt for persistence (cron jobs, SSH keys). Sites, databases, and email kept running — only the control plane was exposed.
What Happened on April 28, 2026
On April 28, 2026, cPanel disclosed a critical authentication vulnerability (CVE-2026-41940) affecting nearly all known versions of cPanel and WHM, including end-of-life releases. The flaw allowed unauthenticated remote attackers to bypass the login flow entirely and gain full access to cPanel, WHM, and Webmail interfaces.
KnownHost, one of the first providers to publicly respond, confirmed that successful exploits were already seen in the wild before the patch was released. Within hours, major hosting providers including hosting.com, Namecheap, KnownHost, HostPapa, and InMotion Hosting blocked cPanel ports at the network level while awaiting the fix.
This is not a theoretical risk — this was an actively exploited zero-day that forced an industry-wide emergency response, landing in the same volatile month as the record Patch Tuesday and ransomware wave.
Technical Details: CVE-2026-41940
| Attribute | Detail |
|---|---|
| CVE | CVE-2026-41940 |
| Severity | Critical (CVSS not published at disclosure) |
| Impact | Authentication bypass — full unauthorized access to cPanel/WHM |
| Scope | All cPanel & WHM versions after 11.40, including EOL releases |
| Attack vector | Remote, unauthenticated — no credentials required |
The vulnerability existed in the authentication layer of the cPanel login flow. While cPanel has not publicly disclosed the exact technical mechanism, the flaw operated at the session validation level — an attacker could establish a fully authenticated session without ever presenting valid credentials.
The Ports That Went Dark
The emergency ports blocked by providers:
- 2082/2083 — cPanel HTTP/HTTPS
- 2086/2087 — WHM HTTP/HTTPS
- 2095/2096 — Webmail
- 2077/2078 — WebDisk
Websites, databases, and email continued operating normally — only the control panel interfaces were affected. That separation is precisely why port-blocking worked as an emergency control.
Timeline of Events
- Discovery: vulnerability found by security researchers (exact timeline undisclosed)
- April 28, ~16:00 UTC: cPanel publishes the security advisory
- Within 1 hour: major hosting providers block cPanel ports globally
- ~2–3 hours after advisory: cPanel releases patches for all supported versions
- ~6–7 hours: major providers complete patch deployment
- April 29: security community publishes detailed analysis (watchTowr, BleepingComputer)
Patched Versions
cPanel released patches for the following builds:
- 11.86.0.41+
- 11.110.0.97+
- 11.118.0.63+
- 11.126.0.54+
- 11.130.0.19+
- 11.132.0.29+
- 11.136.0.5+
- 11.134.0.20+
If your build predates any of these on its branch, you are unpatched — run upcp or update via WHM immediately.
Immediate Actions for Security Teams
- Verify your version — check your cPanel build against the patched list above
- Apply the update immediately — run upcp or update via WHM
- Audit access logs — check for unauthorized sessions during the disclosure window
- Review WHM action logs — look for configuration changes, account creations, or email modifications
- Rotate credentials — change all cPanel, FTP, email, and database passwords
- Check for persistence — hunt for unauthorized cron jobs, SSH keys, or custom scripts
Lessons Learned
- Control plane is the crown jewel: the vulnerability wasn’t in websites or applications — it was in the management interface. cPanel access means everything: filesystem, databases, email, DNS, SSL certificates.
- Speed of response matters: providers that blocked ports within minutes limited their exposure window. An incident response plan for control-plane vulnerabilities is not optional.
- EOL software is not safe: end-of-life cPanel versions were affected too. Outdated control panel software compounds hidden risk over time.
- Defense in depth works: port blocking, firewall rules, and network segmentation were the primary defense while patches were still being built — textbook zero-trust thinking applied to infrastructure.
Other Active CVEs This Week
- CVE-2026-3844: WordPress Breeze Cache plugin — unauthenticated arbitrary file upload leading to RCE
- 216 new plugin/theme vulnerabilities reported in the WordPress ecosystem, 29 still unpatched
- Microsoft Patch Tuesday: 168 flaws including an exploited SharePoint zero-day — full breakdown in our April 2026 Patch Tuesday analysis
Key Takeaways
- CVE-2026-41940 was an actively exploited, unauthenticated full-bypass of cPanel/WHM — not a theory
- Patched builds start at 11.86.0.41+ through 11.136.0.5+ per branch — verify yours now
- If exposed during the window, assume compromise: audit logs, rotate credentials, hunt persistence
- Network-level port blocking bought the ecosystem time — keep that playbook ready
- April 2026’s control-plane panic pairs with the month’s wider zero-day and ransomware surge
FAQ
What is CVE-2026-41940?
A critical authentication bypass in cPanel and WHM disclosed April 28, 2026. It let unauthenticated remote attackers establish valid sessions on cPanel, WHM, and Webmail without credentials. Exploitation was observed in the wild before the patch shipped.
Which cPanel versions are affected by CVE-2026-41940?
All versions after 11.40 — including end-of-life releases. Patched builds are 11.86.0.41+, 11.110.0.97+, 11.118.0.63+, 11.126.0.54+, 11.130.0.19+, 11.132.0.29+, 11.136.0.5+, and 11.134.0.20+.
How did hosting providers respond to the cPanel zero-day?
Within about an hour of the advisory, providers including hosting.com, Namecheap, KnownHost, HostPapa, and InMotion Hosting blocked ports 2082/2083 (cPanel), 2086/2087 (WHM), 2095/2096 (Webmail), and 2077/2078 (WebDisk) at the network level until patches deployed. Customer websites, databases, and email were unaffected.
What should I do if my server was exposed during the disclosure window?
Assume compromise. Patch immediately, audit cPanel access and WHM action logs for the window, rotate all cPanel/FTP/email/database credentials, and check for persistence — rogue cron jobs, SSH keys, and uploaded scripts.
Did websites go down during the cPanel incident?
No. Only the control-panel interfaces were blocked. Websites, databases, and email continued operating normally throughout the emergency response.
References
- cPanel Security Advisories
- watchTowr Labs Research
- BleepingComputer Coverage
- Hmmnm — Microsoft April 2026 Patch Tuesday Analysis
Related Reading
Part of our Cyber Threat Intelligence & CVE Analysis: The Complete Guide series.
n
