cPanel: Know if you’re exposed. Act before threat actors do.

A critical cPanel and WHM authentication bypass vulnerability, CVE-2026-41940, is being actively exploited. If you run cPanel, WHM, WP Squared, or host customer websites, you need to verify your exposure, patch status, and signs of compromise now.

Unsure whether your cPanel or WHM servers are exposed or already compromised? Eye Security can help with:

cPanel/WHM exposure review
confirming patch status
reviewing IOCs and signs of compromise
assessing persistence or backdoor risk
temporary EDR/MDR monitoring options

cPanel CVE-2026-41940: Check exposure, patch status, and compromise risk

cPanel: Know if you’re exposed. Act before threat actors do.

Unsure whether your cPanel or WHM servers are exposed or already compromised? Eye Security can help with:

cPanel/WHM exposure review
confirming patch status
reviewing IOCs and signs of compromise
assessing persistence or backdoor risk
temporary EDR/MDR monitoring options

Get urgent cPanel support

Book a consultation

cPanel CVE-2026-41940: Know if you’re exposed. Act before threat actors do.

Unsure whether your cPanel or WHM servers are exposed or already compromised? Eye Security can help with a cPanel/WHM exposure review, confirming patch status, reviewing IOCs and signs of compromise, assessing persistence or backdoor risk, and temporary EDR/MDR monitoring options.

Get urgent cPanel support

Book a consultation

CVE: CVE-2026-41940

Affected products: cPanel, WHM, WP Squared

Priority: Patch now, then check for persistence or backdoors

NCSC-NL rating: High likelihood / high impact

Status: Actively exploited in the wild

Risk: Authentication bypass leading to WHM access with root privileges

Check if cPanel/WHM is exposed to the internet

Exposed management interfaces increase risk, especially for hosting and MSP environments.

Confirm version and patch status

Make sure your cPanel, WHM, or WP Squared installation is updated to a fixed version.

Assume patching may not remove persistence

If threat actors accessed the environment before patching, they may have planted backdoors.

Review logs and IOCs

Look for suspicious authentication activity, unexpected WHM access, unusual process execution, newly created users, changed configuration, or unexplained website modifications.

Monitor continuously after remediation

Watch for delayed activation of web shells, credential use, new admin activity, or suspicious outbound traffic.

Check if cPanel/WHM is exposed to the internet

Exposed management interfaces increase risk, especially for hosting and MSP environments.

Confirm version and patch status

Make sure your cPanel, WHM, or WP Squared installation is updated to a fixed version.

Assume patching may not remove persistence

If threat actors accessed the environment before patching, they may have planted backdoors.

Review logs and IOCs

Look for suspicious authentication activity, unexpected WHM access, unusual process execution, newly created users, changed configuration, or unexplained website modifications.

Monitor continuously after remediation

Watch for delayed activation of web shells, credential use, new admin activity, or suspicious outbound traffic.

A critical cPanel vulnerability is under active exploitation

CVE-2026-41940 affects cPanel and WHM versions after 11.40 and before patched releases. The vulnerability can allow unauthenticated remote attackers to bypass authentication and gain unauthorised access to the WHM control panel with root privileges.

For hosting providers, MSPs, and organisations managing multiple websites, the impact can be significant. A compromised cPanel/WHM server can expose hosted websites, databases, credentials, and customer environments.

At least 44,000 IP addresses are likely compromised and involved in scanning and brute-force activity around April 30, according to Shadowserver data.

A critical cPanel vulnerability is under active exploitation

At least 44,000 IP addresses are likely compromised and involved in scanning and brute-force activity around April 30, according to Shadowserver data.

Business email compromise is the new threat to the German mid-market

One vulnerable control panel can become many customer problems

cPanel is widely used by hosting providers, MSPs, and IT service providers to manage websites and server environments at scale. When threat actors gain privileged access, they can:

access or alter hosted websites
steal credentials or configuration data
plant backdoors for later use
move across hosted environments
hide traces of compromise
return after patching if persistence remains

Patching may not be enough if exploitation happened before the update was applied.

One vulnerable control panel can become many customer problems

cPanel is widely used by hosting providers, MSPs, and IT service providers to manage websites and server environments at scale. When threat actors gain privileged access, they can:

access or alter hosted websites
steal credentials or configuration data
plant backdoors for later use
move across hosted environments
hide traces of compromise
return after patching if persistence remains

Patching may not be enough if exploitation happened before the update was applied.

Eye Security moved overnight to protect European customers

When the cPanel unauthenticated RCE risk emerged, Eye Security’s research and SOC teams moved fast.

Within hours, we:

analysed the vulnerability
reproduced the authentication bypass and root-level access path
scanned across our customer base
identified cPanel instances across dozens of customers
verified whether environments were patched, mitigated, or still at risk
began sharing indicators and scripts with the wider security community

Most identified customer environments were already safe, patched, or mitigated. But for organisations that are unsure of their cPanel status, the risk remains real.

Eye Security moved overnight to protect European customers

When the cPanel unauthenticated RCE risk emerged, Eye Security’s research and SOC teams moved fast.

Within hours, we:

analysed the vulnerability
reproduced the authentication bypass and root-level access path
scanned across our customer base
identified cPanel instances across dozens of customers
verified whether environments were patched, mitigated, or still at risk
began sharing indicators and scripts with the wider security community

Most identified customer environments were already safe, patched, or mitigated. But for organisations that are unsure of their cPanel status, the risk remains real.

Urgent cPanel exposure support for European organisations

Eye Security can help MSPs, web hosters, and organisations running cPanel understand whether they are exposed and what to do next.

Where we support:

cPanel/WHM exposure review
detection of potentially affected assets
guidance on patching and mitigation
IOC-based checks
EDR/MDR monitoring for suspicious post-compromise activity
incident response support if compromise is suspected
support for MSPs managing multiple customer environments

For MSPs and hosting providers, we can also discuss temporary monitoring options for cPanel servers where compromise cannot be confidently ruled out.

cPanel CVE-2026-41940: Check exposure, patch status, and compromise risk

cPanel: Know if you’re exposed. Act before threat actors do.

cPanel: Know if you’re exposed. Act before threat actors do.

cPanel CVE-2026-41940: Know if you’re exposed. Act before threat actors do.

NCSC-NL advises organisations to install the available updates as soon as possible.

If you run cPanel or WHM, take these steps.

What happened and how Eye Security can help now.

A critical cPanel vulnerability is under active exploitation

One vulnerable control panel can become many customer problems

Eye Security moved overnight to protect European customers

Urgent cPanel exposure support for European organisations

Solutions

Resources

Eye Security