Critical cPanel Vulnerability Under Active Exploitation, Threatening Millions of Websites

Security researchers have issued an urgent alert concerning the active exploitation of a critical vulnerability, tracked as CVE-2026-41940, found in the widely used web server management software cPanel and WebHost Manager (WHM). This severe flaw empowers malicious actors to remotely bypass login screens and gain complete administrative control over servers utilizing these prevalent software suites. Given that cPanel and WHM are deployed across an estimated tens of millions of websites globally, the potential impact of this vulnerability is substantial, threatening widespread disruption and data compromise.

The vulnerability specifically allows an attacker to bypass the authentication process for the software's administration panel, granting them unrestricted access. cPanel and WHM are integral tools for managing web servers, overseeing website hosting, email services, and critical configurations and databases essential for maintaining internet domains. Their deep-seated access to the core server infrastructure means that an attacker, once through the login screen, could potentially achieve unfettered access to all data and functions managed by the affected software, presenting a significant threat to data integrity, user privacy, and operational continuity.

The urgency of this situation is underscored by an advisory from Canada’s national cybersecurity agency, which has stated that “exploitation is highly probable” and necessitates immediate action from cPanel customers or their respective web hosts. This warning highlights the particular risk to websites hosted on shared servers, a common setup provided by large web hosting companies. While many commercial web hosting providers have already proactively patched their customers’ systems, the cPanel maker itself has urged all users to ensure their systems are updated, as the bug affects all supported versions of the software.

Specific responses from major web hosting companies illustrate the gravity of the threat. Namecheap, a prominent hosting provider that uses cPanel for its customer server management, took swift action by blocking access to customer cPanel panels immediately upon learning of the flaw. This pre-emptive measure was implemented to prevent exploitation and allow the company sufficient time to apply necessary patches across its customer base. Similarly, HostGator confirmed it had patched its systems and classified the vulnerability as a “critical authentication — bypass exploit,” reflecting the severe nature of the security hole.

Further emphasizing the active nature of this threat, KnownHost CEO Daniel Pearson disclosed that his company had observed attempts to exploit the vulnerability for several months, with records indicating activity as early as February 23. KnownHost also implemented temporary blocks on customer access before rolling out patches. According to Pearson, approximately 30 servers out of thousands on KnownHost’s network showed signs of unauthorized attempted access. While Pearson characterized these incidents as attempts rather than confirmed active compromises at his specific company, they underscore the persistent and long-standing interest from malicious actors in leveraging this flaw.

The widespread adoption of cPanel and WHM across the web hosting industry means that any unpatched systems remain highly susceptible to compromise. This pervasive risk necessitates a comprehensive and immediate response from all affected parties. In related developments, cPanel also released a security fix for WP Squared, a similar tool utilized for managing WordPress websites, indicating a broader focus on securing critical web management platforms against evolving cyber threats.