cPanel and WHM Authentication Bypass Vulnerability (CVE-2026-41940) Security Advisory

1. Apply Official Security Patches

Immediately update your cPanel & WHM installation to the latest secure version using the official update script.

# Log in to your server via SSH as root and run the update command
/usr/local/cpanel/scripts/upcp

2. Temporary Mitigation (If patching cannot be applied immediately)

If immediate patching is not feasible, restrict access to the cPanel/WHM administration ports using a firewall to allow only trusted IP addresses.

• Target Ports:
• cPanel: 2082 (HTTP), 2083 (HTTPS)
• WHM: 2086 (HTTP), 2087 (HTTPS)

Example using firewalld:

# Remove public access to WHM HTTPS port
firewall-cmd --permanent --zone=public --remove-port=2087/tcp
# Allow access only from a trusted IP (e.g., 192.168.1.100)
firewall-cmd --permanent --zone=trusted --add-source=192.168.1.100
firewall-cmd --permanent --zone=trusted --add-port=2087/tcp
firewall-cmd --reload

CVE-2026-41940 is a critical authentication bypass vulnerability in the login flow of cPanel and WHM. Due to a Missing Authentication for Critical Function (CWE-306), unauthenticated remote attackers can bypass the standard authentication sequence by sending crafted HTTP requests, allowing them to establish unauthorized administrative sessions.

With a CVSS 3.1 score of 9.8 (Critical), this vulnerability requires no privileges or user interaction to exploit. It has been added to the CISA KEV catalog due to active exploitation in the wild, and its high EPSS score of 0.94 highlights the extreme urgency of remediation.