Act
active
cPanel/WHM Auth Bypass CVE-2026-41940 Actively Exploited
- Engineer — Act: cPanel/WHM is widely deployed as a hosting control panel; authentication bypass with CISA KEV listing, EPSS 0.99, and a public PoC means exploitation is trivial and active. Patch cPanel/WHM immediately to the vendor-issued fixed version and audit access logs for any unauthorized sessions.
- SOC/IR — Act: Active exploitation of an internet-facing control panel auth bypass warrants an immediate assume-breach sweep on any cPanel/WHM instances in your estate. Hunt for anomalous authenticated sessions or privilege escalation activity since the PoC dropped, and tune detections for unauthenticated access patterns against port 2083/2087.
- Leader — Act: CISA KEV listing with EPSS 0.99 on a widely-used hosting panel is a board-question-level event — confirm whether your infrastructure or managed hosting vendors run cPanel/WHM and request written confirmation of patching status before end of week.
- Signals: CVE-2026-41940 — CISA KEV: listed, EPSS 0.99, public PoC on GitHub
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.