November 2026 • Security

Facts on this page come from NVD, the CISA Known Exploited Vulnerabilities (KEV) catalogue, cPanel support articles, the cPanel blog and cPanel documentation, read on 7 November 2026. Where a fact comes only from news sites or a hosting provider, we say so. CVSS scores differ by scorer and version, so we name the source of each score.

cPanel security in 2026 is shaped by CVE-2026-41940, a cPanel authentication bypass in cPanel & WHM. It let an unauthenticated remote attacker gain access to the control panel. cPanel released fixes on 28 April 2026, and CISA added the flaw to its KEV catalogue on 30 April 2026. CISA's catalogue lists the flaw as exploited.

This page checks the main facts of this cPanel vulnerability against NVD, CISA and cPanel's own advisories. It also covers three further CVEs fixed on 8 May 2026, a selection of later cPanel security advisories, what cPanel told operators to do, and a checklist for any cPanel server. It closes with what this means when you choose a panel. Every panel can have vulnerabilities, including ours.

CVE-2026-41940: cPanel security facts we verified

Item What the sources say Source
Type The cPanel authentication bypass sits in the login flow. An unauthenticated remote attacker can gain access to the control panel. Weakness class: CWE-306, missing authentication for a critical function. NVD, CISA KEV
Cause, as cPanel describes it Two code paths write session files to disk. One path sanitised its input. A second path, used when handling Basic authentication, did not. A crafted request could make an unauthenticated session count as authenticated. cPanel blog, 10 May 2026
Affected products All cPanel & WHM versions after 11.40, including DNSOnly. WP Squared (the WordPress edition built on cPanel) is also affected. cPanel says no other WebPros products are affected. cPanel support article and blog
Fixed versions (supported lines) 11.86.0.41, 11.94.0.28, 11.102.0.39, 11.110.0.97, 11.118.0.63, 11.124.0.35, 11.126.0.54, 11.130.0.19, 11.132.0.29, 11.134.0.20 and 11.136.0.5, or higher. WP Squared: 136.1.7 or higher. cPanel added some versions to the article later: 11.124 on 1 May and 11.94 and 11.102 on 5 May. cPanel support article
Severity score cPanel states a CVSS score of 9.8, assigned by VulnCheck. The NVD record shows VulnCheck's CVSS 4.0 base score of 9.3 (Critical), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. NVD had not added its own assessment when we read the record. A vendor-published analysis gives the CVSS 3.1 vector for 9.8 as AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. cPanel blog, NVD
CISA KEV Added 30 April 2026, with a due date of 3 May 2026 for US federal agencies. The KEV catalogue is CISA's list of vulnerabilities known to be exploited. CISA KEV
Exploited before the patch Reported by news sites, which attribute it to a hosting provider (KnownHost); the sources we read differ on whether this was a statement of fact or speculation (one quotes "the last 30 days if not longer", others cite 23 February 2026), and we could not read the original post. The cPanel pages we read do not state when exploitation began. News reports (secondary)

Where sources disagree

  • KEV date: the cPanel blog says CISA added the flaw on 1 May 2026. CISA's own entry and NVD say 30 April 2026.
  • Fixed version of the 11.136 line: cPanel's article says 11.136.0.5. A Singapore government alert says versions before 11.136.0.7 are affected. We use cPanel's figure.
  • Score: 9.8 and 9.3 are both correct, but they come from different CVSS versions. Compare scores only within the same version.

Timeline of the cPanel authentication bypass

Date (2026) Event Source
23 February Earliest reported exploitation attempts, according to the KnownHost CEO. Not confirmed by cPanel. News reports (secondary)
27 April cPanel confirms the vulnerability at 10:47 CDT after a second report, and starts incident response. A report earlier in April could not be reproduced and was not classified as a vulnerability. cPanel blog
28 April Advisory published at 12:08 CDT. Updated builds for all supported tiers were published at 16:19 CDT, about 28 hours after confirmation. cPanel blog
29 April cPanel emails partners and customers and publishes a detection script for indicators of compromise. A CVE identifier is assigned and NVD publishes the record. Security firm watchTowr publishes a technical analysis and proof of concept. cPanel blog, NVD, Rapid7
30 April CISA adds CVE-2026-41940 to the KEV catalogue. CISA KEV
1 May cPanel updates the detection script to remove a false positive on session lock files and sends a second email with more version coverage. cPanel blog
8 May cPanel fixes three further CVEs (see below). cPanel support articles
10 May cPanel states that more than 98% of servers worldwide run an updated version. cPanel blog

What cPanel told operators to do

These steps come from the cPanel security advisory for CVE-2026-41940, last updated in May 2026.

  1. Update to a fixed version with /scripts/upcp --force. Check the version with /usr/local/cpanel/cpanel -V and restart the service with /scripts/restartsrv_cpsrvd --hard.
  2. Check servers where updates are disabled or pinned to one version. They do not update on their own. cPanel says servers on CentOS 7 or CloudLinux 7 must be set to version 11.110.
  3. If you cannot update, block inbound traffic on ports 2083, 2087, 2095 and 2096 and disable service subdomains, or stop the cpsrvd and cpdavd services.
  4. Run the detection script on any server that was unpatched at any point. Use the current version of the script, because cPanel revised it to remove false positives.
  5. If the script finds indicators of compromise: purge the affected sessions, force a password reset for root and all WHM users, audit the login records and WHM access logs, and look for persistence such as cron jobs, SSH keys and backdoors.
  6. If the server is confirmed as compromised at root level: move the accounts to a known clean server, or reinstall the operating system and restore accounts from backups.

The Canadian Centre for Cyber Security gave similar advice. It also recommended restricting network access to cPanel and WHM, for example with firewall IP allow-lists, until the patch is installed, and reviewing logs for unusual logins. Patching closes the flaw but does not remove access that an attacker already gained.

The three further CVEs of May 2026

On 8 May 2026, cPanel released fixes for CVE-2026-29201, CVE-2026-29202 and CVE-2026-29203. Fixed versions include 11.136.0.9, 11.134.0.25, 11.132.0.31, 11.130.0.22, 11.126.0.58, 11.124.0.37, 11.118.0.66, 11.110.0.117, 11.102.0.41, 11.94.0.30 and 11.86.0.43, and a WP Squared build listed in cPanel's advisory. CVE-2026-29202 and CVE-2026-29203 are described as needing an authenticated user. For CVE-2026-29201 the sources differ: the CVE assigner's vector shows no privileges required, and CISA's added data shows low privileges. None of the three is an unauthenticated login bypass like CVE-2026-41940, but they matter on servers with many customer accounts.

CVE Issue (from cPanel and NVD) Scores shown in NVD
CVE-2026-29201 Arbitrary file read. The feature file name is not validated in an internal call, so a relative path can make any file readable by all users. CVSS 3.1: 8.6 High from the CVE assigner (HackerOne); 4.3 Medium from CISA's added data
CVE-2026-29202 Perl code injection in the create_user API call, through the plugin parameter. The code runs as the system user of the authenticated account. CVSS 4.0: 5.3 Medium from HackerOne. The Belgian CCB advisory of 12 May reports CVSS 3.1 of 8.8
CVE-2026-29203 Unsafe symbolic link handling lets a user change permissions on an arbitrary file. This can cause denial of service and possible privilege escalation. NVD ties it to the cPanel Nova plugin. CVSS 4.0: 5.3 Medium from HackerOne. The Belgian CCB advisory reports CVSS 3.1 of 8.8

We found no CISA KEV entry and no cPanel statement of exploitation for these three as of 7 November 2026. That is not proof that nobody exploited them. The scores differ between sources and have changed over time, so read the current NVD record before you rely on a number.

Later cPanel advisories, July to October 2026

The cPanel authentication bypass was not the last cPanel security issue of the year. Each row is a separate cPanel vulnerability, listed from cPanel's security section as a selection. We did not check the exploitation status of each one.

CVE or item What cPanel says Date
CVE-2026-58047 HTTP request smuggling in the cpsrvd web server. In some situations an unauthenticated remote attacker may change the responses that other users on the server receive. Late July
CVE-2026-58048 Privilege escalation in database functionality. An authenticated account holder with MySQL or MariaDB access could run database commands with full administrative rights. Late July
CVE-2026-65643 An authenticated account holder who can add parked or addon domains can create arbitrary files. cPanel says this leads to code execution as root. 27 August
CVE-2026-67401 SQL injection in the EmailTrack function. cPanel says successful exploitation gives code execution as root. 8 September
CVE-2026-93697 Stored cross-site scripting in the WHM mass account modification screen. An unprivileged account holder could run script in a WHM administrator's session. 29 September
CVE-2026-109618 and CVE-2026-109619 Critical remote code execution flaws in PHP itself, not in cPanel. cPanel shipped fixed PHP packages and product releases on 21 October. cPanel cites a CVSS 4.0 score of 9.2 for both. 21 October
CVE-2026-105476 An authenticated remote user can write arbitrary files owned by root. Fixed in 110.0.154, 134.0.67, 136.0.51 and 138.0.19, or higher. 26 October

cPanel security checklist for any server

1. Version and update settings

This cPanel security checklist applies to any server, whether you run it yourself or your host does. Run /usr/local/cpanel/cpanel -V and compare the result with the fixed versions in cPanel's advisories and change logs. Check that automatic updates are not disabled and that the server is not pinned to an old release. cPanel says that legacy and unsupported releases do not receive security patches, so plan to move off them.

2. Exposure of ports 2083 and 2087

Port 2083 is the cPanel login over TLS and port 2087 is the WHM login over TLS. Ports 2095 and 2096 serve webmail. cPanel's firewall documentation recommends opening only the ports for services you use, and it warns you to keep console access before you change firewall rules. WHM's Host Access Control screen can allow or deny specific IP addresses per service, and it ignores its rules if you install another firewall on a server that uses nftables. One more point from the same documentation: the license callback needs at least one of several listed ports to stay open, so check that before you close them all.

Service subdomains, such as the cpanel and whm host names, can give access to cPanel and WHM through port 443. cPanel included disabling them in its mitigation for CVE-2026-41940, so include them in your review.

3. Two-factor authentication

In WHM, root can switch on the two-factor security policy, and each user then sets up their own authenticator. cPanel's documentation notes that two-factor does not automatically cover API requests that use a password, unless the Security Policy Extensions option is enabled. A cPanel support article says it is not possible to force two-factor on all cPanel accounts at once. Two-factor is not a replacement for patching: cPanel placed this flaw in session handling, and its detection script treats a two-factor-verified flag in a session that began as a failed login as an indicator of compromise.

4. Brute-force protection and logs

cPHulk, the built-in brute-force protection, monitors cPanel (port 2083), WHM (port 2087), mail services, FTP and SSH. Check that it is on, and review the WHM access log and login records for unfamiliar sources.

5. Compromise check

If the server was unpatched at any time between February and April 2026, run cPanel's detection script and follow the steps above. A clean result for sessions does not prove the server is clean, because an attacker with root access can change files and logs.

What cPanel security means when choosing a panel

A control panel with a login page on the public internet is an attack surface, and cPanel security events like this one show why. For CVE-2026-41940, the weak point sat in the part of cPanel that accepts logins, and WHM gives root-level administration of the server. The cPanel vulnerability was not an unusual one. Any panel is software with a web login, so any panel will have vulnerabilities. The useful questions are about exposure and response.

  • Can you restrict the admin login to known IP addresses, and is that setting easy to use?
  • Can you require two-factor login for administrators?
  • How does the vendor publish advisories, and how quickly are fixes available for the version you run?
  • Who patches the operating system under the panel: you, your host or a managed service?
  • How would you restore from a known clean backup if a server were compromised?

PFHW includes these security features: a ModSecurity web application firewall with OWASP rules, brute-force protection, ClamAV scanning, a host firewall with confirm-or-revert, a Security Advisor, banning of abusive addresses, and two-factor or passkey login. An admin security policy can limit logins to verified IP addresses and require two-factor, password strength and password age. API tokens can have an expiry and an IP restriction. On managed servers, we apply operating system security patches.

These features reduce exposure. They do not make PFHW immune to vulnerabilities, and we do not claim that they do.

Where PFHW fits, and where it does not

Where it fits

  • You want a managed server where engineers handle operating system security patches, the firewall, monitoring and backup administration.
  • You want the admin login limited to verified IP addresses with two-factor required.
  • You want to move cPanel accounts to a clean server. PFHW imports cPanel backup packages after a dry run, and an import that fails is rolled back as a whole.

Where it does not fit

  • Customers keep control of their sites and application code. Management does not cover plugin or application vulnerabilities in your own sites.
  • There is no automatic certificate issuing (no AutoSSL). Certificates are uploaded or bought from us.
  • Mailing lists, autoresponders, email filters and spam-filter settings are not in the PFHW portal. Email is a separate add-on.
  • There is no server-to-server account transfer tool, and the portal interface is English only at present.
  • Good cPanel security practice also applies when you leave cPanel: if your server may be compromised, do not import its accounts without checking the files first. Moving accounts also moves any malware inside them.

Frequently asked questions

Is my server safe once the cPanel authentication bypass is patched?

Patching closes the flaw but does not remove access that an attacker gained earlier. cPanel says any server that was unpatched at any point should be scanned with the current detection script. If the script finds indicators, follow cPanel's steps for sessions, passwords, logs and persistence.

What is the CVSS score of CVE-2026-41940?

cPanel states 9.8, assigned by VulnCheck. NVD shows a CVSS 4.0 base score of 9.3 from VulnCheck. Both are Critical, but they use different CVSS versions.

Was the cPanel authentication bypass exploited before the patch?

News reports say a hosting provider saw exploitation attempts from about 23 February 2026, but the reports differ and we could not read the original post. CISA lists the flaw as exploited, and cPanel's pages we read do not state when exploitation began.

Should I close ports 2083 and 2087?

cPanel offered port blocking as a temporary measure for servers that could not be updated, and the Canadian Cyber Centre advised IP allow-lists until patching. Updating is the real fix. Closing all cPanel ports can also affect license callbacks, so check the documentation first.

How serious are CVE-2026-29201, CVE-2026-29202 and CVE-2026-29203?

Two are described as needing a logged-in user, and the sources differ on the third. Scores differ between sources, from 4.3 to 8.8. Install the 8 May fixes anyway as part of normal cPanel security upkeep, because they affect servers where many customers hold accounts. We found no statement of exploitation.

Does moving to PFHW remove the risk?

No panel is free of vulnerabilities. PFHW offers IP-restricted admin login, required two-factor and managed operating system patching, which reduce exposure. Your own sites and applications remain your responsibility.

Related resources

Sources

Ask about PFHW