cPanel and WHM versions after 11

CVE-2026-41940 is a pre-authentication bypass in cPanel & WHM’s session management layer. A remote attacker can abuse the login flow so cpsrvd writes attacker-controlled session data, then reload that session as authenticated without a valid password. Vendor guidance says every cPanel & WHM version after 11.40 is affected, with fixes shipped across supported branches including 11.86.0.41, 11.94.0.28, 11.102.0.39, 11.110.0.97, 11.118.0.63, 11.124.0.35, 11.126.0.54, 11.130.0.19, 11.132.0.29, 11.134.0.20, 11.136.0.5, plus WP Squared 136.1.7.

The vendor’s 9.8 is fair as a starting point, but real-world conditions push this to a full operational critical. There is no attacker foothold requirement, no credential requirement, the management plane is commonly internet-exposed by design, public technical analysis and PoC material landed immediately, CISA added it to KEV on 2026-05-01, and follow-on compromise activity has already been reported. On multi-tenant hosting nodes, one hit is not one app lost; it is every site, mailbox, database, and reseller account on that server.

Why this verdict

• Baseline stays maxed: vendor 9.8 assumes AV:N/PR:N/UI:N, and that is exactly the real attacker path here.
• No foothold tax: the prerequisite is *public reachability*, not phishing success, internal network position, stolen creds, or a privileged role. That means this is an initial-access bug, not a post-compromise convenience feature.
• Exposure narrowing is real but not enough to save you: only cPanel/WHM fleets are in scope, but those fleets are intentionally internet-facing and concentrated at hosting providers. Censys still saw about 1.1M hosts and 6.7M web properties, so the reachable population remains enormous.
• Blast radius is amplified by tenancy: one compromised control plane can collapse hundreds or thousands of customer sites, mailboxes, and databases on the same node.
• Operational signals push it upward: public watchTowr analysis on 2026-04-29, KEV on 2026-05-01, and exploitation reporting together justify moving from vendor critical to *drop-everything critical*.

Why not higher?

There is no bucket above CRITICAL, and this one already sits at the ceiling. The only meaningful downward pressure is that the flaw targets cPanel/WHM fleets rather than the whole Linux estate, but that scope limit is overwhelmed by internet exposure and control-plane blast radius.

Why not lower?

A lower rating would require real friction such as authenticated access, internal-only reachability, uncommon deployment, or unreliable exploitation. None of those apply cleanly here: the interface is commonly exposed, the exploit path is public, and KEV plus compromise reports say attackers are already cashing it in.

1. Block public access to cPanel ports — If any node is not yet patched, restrict inbound traffic to 2083, 2087, 2095, and 2096 immediately, within hours. This is the fastest way to break the unauthenticated remote path while you finish remediation.
2. Disable service subdomains — Apply the vendor-recommended service-subdomain shutdown where relevant immediately, within hours, so alternate paths do not keep the panel reachable after a port block.
3. Stop cpsrvd and cpdavd on stragglers — For systems that cannot be patched at once, stop the affected services immediately, within hours. This is ugly but appropriate for a KEV-listed pre-auth management-plane bypass.
4. Run the vendor IOC script — Use cPanel’s detection script on any host that was internet-facing before patching, and do it immediately, within hours. This is not just a vuln-validation exercise; it is compromise triage.
5. Constrain admin-plane reachability long term — After emergency handling, move cPanel/WHM behind VPN, allowlists, bastions, or provider-side access controls within the CRITICAL remediation window. The exploit is this week’s fire; the exposure model is the recurring cause.

Run this on the target cPanel/WHM host as root or with sudo; it uses the local cPanel binary and needs no network access. Save it as check_cve_2026_41940.sh, then run sudo bash check_cve_2026_41940.sh to print VULNERABLE, PATCHED, or UNKNOWN and return exit code 1, 0, or 2 respectively.

#!/usr/bin/env bash
# check_cve_2026_41940.sh
# Determine whether the local cPanel/WHM install is vulnerable to CVE-2026-41940.
# Exit codes: 0=PATCHED/NOT_AFFECTED, 1=VULNERABLE, 2=UNKNOWN

set -u

CPANEL_BIN="/usr/local/cpanel/cpanel"

ver_lt() {
  [ "$1" != "$2" ] && [ "$(printf '%s\n' "$1" "$2" | sort -V | head -n1)" = "$1" ]
}

ver_ge() {
  [ "$(printf '%s\n' "$2" "$1" | sort -V | head -n1)" = "$2" ]
}

print_result() {
  local status="$1"
  local detail="$2"
  echo "$status: $detail"
}

if [ ! -x "$CPANEL_BIN" ]; then
  print_result "UNKNOWN" "cPanel binary not found at $CPANEL_BIN"
  exit 2
fi

raw_version="$($CPANEL_BIN -V 2>/dev/null | tr -d '[:space:]')"
version="${raw_version#v}"

if [ -z "$version" ]; then
  print_result "UNKNOWN" "Unable to read cPanel version from $CPANEL_BIN -V"
  exit 2
fi

# Vendor states versions after 11.40 are affected.
if ver_lt "$version" "11.40.0.1" || [ "$version" = "11.40" ] || [ "$version" = "11.40.0.0" ]; then
  print_result "PATCHED" "Installed version $version is not in the affected range (vendor says affected versions are after 11.40)"
  exit 0
fi

# All newer branches after 11.136.0.5 are considered fixed per vendor note that later versions are patched.
if ver_ge "$version" "11.136.0.5"; then
  print_result "PATCHED" "Installed version $version is at or above 11.136.0.5"
  exit 0
fi

# Supported-branch fixed versions from vendor advisory.
if ver_ge "$version" "11.134.0.20" && ver_lt "$version" "11.136.0.0"; then
  print_result "PATCHED" "Installed version $version is fixed in the 11.134 branch"
  exit 0
fi
if ver_ge "$version" "11.132.0.29" && ver_lt "$version" "11.134.0.0"; then
  print_result "PATCHED" "Installed version $version is fixed in the 11.132 branch"
  exit 0
fi
if ver_ge "$version" "11.130.0.19" && ver_lt "$version" "11.132.0.0"; then
  print_result "PATCHED" "Installed version $version is fixed in the 11.130 branch"
  exit 0
fi
if ver_ge "$version" "11.126.0.54" && ver_lt "$version" "11.130.0.0"; then
  print_result "PATCHED" "Installed version $version is fixed in the 11.126 branch"
  exit 0
fi
if ver_ge "$version" "11.124.0.35" && ver_lt "$version" "11.126.0.0"; then
  print_result "PATCHED" "Installed version $version is fixed in the 11.124 branch"
  exit 0
fi
if ver_ge "$version" "11.118.0.63" && ver_lt "$version" "11.124.0.0"; then
  print_result "PATCHED" "Installed version $version is fixed in the 11.118 branch"
  exit 0
fi
if ver_ge "$version" "11.110.0.97" && ver_lt "$version" "11.118.0.0"; then
  print_result "PATCHED" "Installed version $version is fixed in the 11.110 branch"
  exit 0
fi
if ver_ge "$version" "11.102.0.39" && ver_lt "$version" "11.110.0.0"; then
  print_result "PATCHED" "Installed version $version is fixed in the 11.102 branch"
  exit 0
fi
if ver_ge "$version" "11.94.0.28" && ver_lt "$version" "11.102.0.0"; then
  print_result "PATCHED" "Installed version $version is fixed in the 11.94 branch"
  exit 0
fi
if ver_ge "$version" "11.86.0.41" && ver_lt "$version" "11.94.0.0"; then
  print_result "PATCHED" "Installed version $version is fixed in the 11.86 branch"
  exit 0
fi

# Everything after 11.40 but below fixed branch thresholds should be treated as vulnerable.
if ver_ge "$version" "11.40.0.1"; then
  print_result "VULNERABLE" "Installed version $version falls in an affected branch and is below the vendor fixed build for that branch or is on an older unsupported branch"
  exit 1
fi

print_result "UNKNOWN" "Unable to classify installed version $version"
exit 2

Sources

1. cPanel response post
2. cPanel security advisory
3. NVD CVE record
4. watchTowr Labs technical analysis
5. Rapid7 emergent threat response
6. Censys advisory
7. CISA Known Exploited Vulnerabilities Catalog
8. BleepingComputer exploitation report