CVE-2026-41940

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi Dipakai ransomware EPSS 98,5%

Kerentanan Missing Authentication for Critical Function pada cpanel, cpanel whm +1 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut vulncheck.com. Masuk katalog KEV CISA pada 30 April 2026, artinya sudah terbukti dieksploitasi. Tercatat dipakai dalam kampanye ransomware.

Deskripsi (NVD)

cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

Advisory KUTIM-CSIRT

• Kerentanan cPanel & WHM CVE-2026-41940 Dieksploitasi Secara Aktif 29 Apr 2026

Rincian

Terbit di NVD

29 April 2026

Terakhir diubah

30 September 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

98,5% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

Masuk KEV

30 April 2026

Tenggat CISA

3 Mei 2026 (untuk instansi federal AS)

Ransomware

Tercatat dipakai dalam kampanye ransomware

Tindakan wajib

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026 advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41940 pemerintah AS
• https://www.namecheap.com/status-updates/ongoing-critical-security-vulnerability-in-cpanel-april-28-2026 advisory pihak ketiga
• https://www.vulncheck.com/advisories/cpanel-and-whm-authentication-bypass-via-login-flow advisory pihak ketiga
• https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-by... exploit · advisory pihak ketiga
• https://github.com/watchtowrlabs/watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py exploit · advisory pihak ketiga
• https://docs.cpanel.net/release-notes/release-notes release notes
• https://docs.wpsquared.com/changelogs/versions/changelog/#13617 release notes
• https://www.bleepingcomputer.com/news/security/critrical-cpanel-flaw-mass-exploited-in-sorry-ransomware-attack... press/media coverage