cPanel 0-Day Authentication Bypass Vulnerability Actively Exploited in the Wild

Cybersecuritynews •Guru Baran • April 30, 2026

A critical authentication bypass vulnerability in cPanel & WHM has been confirmed to be actively exploited in the wild, sending shockwaves through the global web hosting industry. The flaw, tracked as CVE-2026-41940, allows unauthenticated attackers to bypass login mechanisms entirely, potentially granting root-level access to affected hosting control panels. A public proof-of-concept (PoC) exploit has […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

cPanel and WHM Critical Auth Bypass Vulnerability Patched A critical authentication vulnerability affecting all supported versions of cPanel and WHM was disclosed on April 28, 2026. This flaw allows attackers to gain unauthorized access to the control panel, posing significant risks to web hosting servers. The vulnerability has not been assigned a CVE identifier, and no technical details have been publicly disclosed. cPanel has issued an emergency update requiring administrators to run a specific command to apply the patch. Hosting providers, including Namecheap, temporarily blocked access to affected ports to protect customers until the patch was available. Administrators are urged to update immediately to prevent potential exploitation, as attackers could control hosting accounts and deploy malicious activities. The scope of impact is broad, affecting numerous web hosting providers and their customers. As of now, the vulnerability has been patched, but the lack of attribution raises concerns about future exploitation. 69 sources 72

Extracted Entities

cPanel 0-Day Authentication Bypass Vulnerability Actively Exploited in the Wild

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)