Critical Authentication Bypass in cPanel & WHM Exposes Hosting Admin Access

A critical authentication bypass flaw, tracked as CVE-2026-41940, affects cPanel & WHM and WP Squared deployments and has been publicly reported as under active exploitation. The vulnerability can let unauthenticated remote attackers bypass normal login controls in certain conditions and potentially obtain administrative access to internet-facing hosting systems that manage websites, databases, email, DNS, SSL certificates, and customer accounts.

Guidance tied to the disclosure urges organizations to apply vendor-patched builds immediately and investigate for signs of compromise, as a successful breach could expose downstream environments and sensitive business data. Recommended response actions include isolating affected servers, rotating credentials, removing attacker persistence, and rebuilding compromised systems, alongside longer-term hardening such as MFA, network segmentation, reduced internet exposure, tighter privileged access, and continuous vulnerability monitoring.