What happened
CVE-2026-41940 is an authentication bypass in cPanel, WHM and WP Squared. NVD rates it 9.8 on CVSS 3.1 and 9.3 on CVSS 4.0. The vulnerability lets an attacker enter the panel without a password, which means access to every site, database and mailbox on the server.
CISA has added it to the Known Exploited Vulnerabilities catalog. According to researchers, attacks began in late February 2026, two months before the patch was released, and a public proof of concept appeared the day after it.
Who is affected
All cPanel and WHM builds after 11.40 are affected, which means practically every running installation that has not been updated since April 28, 2026. WP Squared is affected separately.
How to check your build
/usr/local/cpanel/cpanel -V
cat /usr/local/cpanel/versionCompare the number with the fixed builds for your release branch:
| Branch | Fixed starting with |
|---|---|
| 11.136 | 11.136.0.5 (later 11.136.0.9) |
| 11.134 | 11.134.0.20 (later 11.134.0.25) |
| 11.132 | 11.132.0.29 (later 11.132.0.31) |
| 11.130 | 11.130.0.19 |
| 11.126 | 11.126.0.54 |
| 11.118 | 11.118.0.63 |
| 11.110 | 11.110.0.97 |
| 11.86 | 11.86.0.41 |
The build numbers are taken from researchers' summaries. Before updating, check the official cPanel announcement: later builds fix three more vulnerabilities in the same product that allow file reading, code execution and privilege escalation.
How to update
/usr/local/cpanel/scripts/upcp --force
/usr/local/cpanel/cpanel -VThe update takes from a few minutes to half an hour, depending on the server. Sites keep running during the update: only the panel services are restarted.
If you cannot update right now
Close the panel ports in the firewall and leave access only from your own addresses. cPanel and WHM ports: 2082, 2083, 2086, 2087, 2095, 2096.
sudo firewall-cmd --permanent --remove-port=2087/tcp
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=YOUR.ADDRESS/32 port port=2087 protocol=tcp accept'
sudo firewall-cmd --reload
sudo systemctl restart cpsrvdRestarting the cpsrvd service is required; otherwise the rule does not take effect for current sessions. This is a temporary measure: it keeps outsiders away from the panel but does not remove the vulnerability itself.
What to check after updating
The vulnerability was exploited for more than two months before the patch appeared, so updating is not enough. You need to confirm that nobody got in earlier.
- The WHM user list: look for accounts you did not create.
- The login log:
grep -i 'login' /usr/local/cpanel/logs/access_log | tail -100. - Cron jobs of all users:
for u in $(ls /var/cpanel/users); do echo "== $u"; crontab -l -u "$u" 2>/dev/null; done. - SSH keys:
find /home -name authorized_keys -newermt '2026-02-01' -ls.
A detailed guide to the signs of compromise is in a separate article in our knowledge base.
Frequently asked questions
I have cPanel automatic updates enabled. Am I safe?
Check the actual build with /usr/local/cpanel/cpanel -V. Automatic updates are sometimes disabled after manual changes or fail because of low disk space.
Does two-factor authentication in cPanel protect against CVE-2026-41940?
No. The vulnerability bypasses the authentication mechanism itself, so the second factor is never requested.
I don't use WP Squared. Is it still dangerous?
If the component is installed, it is vulnerable whether or not you use it. Update or remove it.
What should ZevsHost customers do?
On shared hosting servers we update the panel. If you have a VPS or dedicated server with cPanel, the update is up to you: the server is under your control.