CVE-2026-41940Vulnerability
WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability
Reported by 4 independent sources · first reported by watchTowr Labs · last reported
Last reported yesterday
Fix due 3 May 2026
Used by ransomware: knownCISA KEV catalogue
higher than 99% of CVEsFIRST EPSS, as of 21 Oct 2026
What the reports say
4 reports, newest first · the exact sentence from each-
Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions“CVE-2026-41940 (cPanel/WHM authentication bypass) (Actively exploited)”
-
INC and The Gentlemen Ransomware: Exposed AI Infrastructure“…236 targets, 108 created admins, 4,140 managed endpoints), SimpleHelp (CVE-2024-57727, 242 unique IP addresses impacted) and cPanel (CVE-2026-41940, 49+ claimed breaches)”
-
TSUBAME Report Overflow (Apr-Jun 2026)“…rease may have been associated with infection activity involving Mirai or its variants that exploited a vulnerability in cPanel/WHM (CVE-2026-41940).”
-
The Internet Is Falling Down, Falling Down, Falling Down (cPanel & WHM Authentication Bypass CVE-2026-41940)“The Internet Is Falling Down, Falling Down, Falling Down (cPanel & WHM Authentication Bypass CVE-2026-41940)”
Indicators reported together
named in the same reports- 45.227.254[.]43in 2 reports
- 11.110.0[.]96in 1 report
- 11.118.0[.]61in 1 report
- 11.126.0[.]53in 1 report
- 11.132.0[.]27in 1 report
- 11.134.0[.]19in 1 report
- 11.136.0[.]4in 1 report
- 11.110.0[.]97in 1 report
- session[.]pmin 1 report
- load[.]pmin 1 report
Copy these 10 indicators · defanged
Also named with it: CVE-2026-35616, CVE-2024-57727, CVE-2026-42208, CVE-2025-49113, CVE-2026-15409, CVE-2026-63030, CVE-2020-1472, CVE-2021-42278, CVE-2021-1675, CVE-2026-9082
Thanks — we review every report.