{"id":22675,"date":"2026-05-06T16:41:48","date_gmt":"2026-05-06T16:41:48","guid":{"rendered":"https:\/\/www.webhosting.uk.com\/kb\/?p=22675"},"modified":"2026-05-07T13:43:34","modified_gmt":"2026-05-07T13:43:34","slug":"cpanel-security-advisory-cve-2026-41940-critical","status":"publish","type":"post","link":"https:\/\/www.webhosting.uk.com\/kb\/cpanel-security-advisory-cve-2026-41940-critical\/","title":{"rendered":"cPanel Security Advisory \u2013 CVE-2026-41940 (Critical)"},"content":{"rendered":"

Overview<\/strong><\/h2>\n

On 28th April 2026, a critical security vulnerability affecting cPanel and WHM (CVE-2026-41940) was publicly disclosed.<\/p>\n

This advisory explains the nature of the vulnerability, the actions we took to secure affected systems, and the steps we recommend customers take to review their own environments.<\/p>\n

\n

What is the vulnerability?<\/strong><\/h2>\n

This vulnerability affects the authentication mechanism within cPanel and WHM and could allow an unauthenticated remote attacker to gain unauthorised administrative access to the control panel, potentially including root-level access to the underlying server.<\/p>\n

The vulnerability carries a CVSS score of 9.8 out of 10 (Critical)<\/strong> and affected all versions of cPanel and WHM prior to the patched releases.<\/p>\n

For a full list of affected and patched versions, please refer to the official cPanel security advisory.<\/a><\/p>\n

\n

Our response<\/strong><\/h2>\n

We acted immediately upon public disclosure on 28th April 2026:<\/p>\n