Yes—official sources reported active exploitation of CVE-2026-41940, a critical authentication bypass affecting cPanel & WHM. An attacker could gain administrative access without authenticating, putting hosted sites, databases, email, and server configuration at risk. Administrators should compare their installed build with cPanel’s current security advisory, install the applicable update, and check for signs of compromise if the server was exposed while unpatched. Updating now does not establish that an earlier intrusion did not occur.
What happened in CVE-2026-41940?
In an April 28, 2026 advisory, cPanel described an authentication-bypass vulnerability affecting cPanel software, including DNSOnly. Its May 10 technical response explained that one of two session-file writing paths did not sanitize input during Basic authentication handling. Specially crafted input could cause an unauthenticated session to be treated as authenticated.
The Cyber Security Agency of Singapore (CSA) reported active exploitation and public availability of a proof of concept. cPanel said the vulnerability was added to the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog on May 1, 2026. Those reports establish that exploitation occurred; they do not establish whether a particular server was accessed.
Is a cPanel or WHM server vulnerable?
Use the installed cPanel build and the current vendor advisory to determine exposure. cPanel’s April 28 notice described affected software as versions after 11.40 and listed fixed-build floors for individual release branches. A major-version label alone is not enough to establish that a server is patched: compare the complete installed version with the applicable branch floor and the live advisory and changelog.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
The advisory listed these patch floors for branches:
- 11.86.0.41
- 11.94.0.28
- 11.102.0.39
- 11.110.0.97
- 11.118.0.63
- 11.124.0.35
- 11.126.0.54
- 11.130.0.19
- 11.132.0.29
- 11.134.0.20
- 11.136.0.5
These are the floors reported in the advisory, not a substitute for checking current guidance. The notice also covered a WP Squared patch and a legacy CentOS 6/CloudLinux 6 update; consult the vendor advisory for the applicable build in those cases. cPanel said later builds were patched. Because branch support and release guidance can change, verify the installed version against cPanel’s current CVE-2026-41940 advisory and changelog before deciding that a host is safe.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
What should administrators do?
Install the applicable update
Use the vendor’s current instructions to update the server to a fixed build for its branch. cPanel said it made updates available for supported versions and select legacy versions about 28 hours after confirming a reproducible report. That response timeline does not replace checking whether this particular server actually received the right update.
Restrict exposure if an immediate update is not possible
CSA recommends restricting external connectivity to cPanel and WHM ports 2083 and 2087, and webmail ports 2095 and 2096. Alternatively, its guidance says to stop the core services cpsrvd and cpdavd. Follow the current vendor or CSA instructions for applying these mitigations safely in your environment; reducing reachability is a temporary protective measure, not a patch.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Check for indicators of compromise
cPanel provides mitigation instructions and an indicator-of-compromise detection script. It says servers that were unpatched at any point during the incident window should be scanned using the current version of that script. Follow the vendor’s current instructions for obtaining and running it, then investigate any findings. A successful patch installation fixes the vulnerability but does not prove that an attacker did not gain access before the update.
Escalate when you lack server access
If a hosting provider manages the server, ask it to confirm the complete installed cPanel build, when the security update was applied, whether the host was exposed while unpatched, and whether the current cPanel detection script was run. For any suspected compromise, ask the provider to investigate relevant system and service logs and explain its containment and recovery plan. Do not treat an update confirmation alone as a clean bill of health.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
How does CVE-2026-41940 differ from other cPanel vulnerabilities?
cPanel’s security index listed multiple additional advisories through September 29, 2026. The examples below are separate issues with different prerequisites; their existence does not mean every server is affected by each one. The sampled notices’ fixed-version floors should be checked in their respective live advisories rather than inferred from the CVE-2026-41940 branch list.
| CVE and notice | Prerequisite and affected area | Reported impact or status | Fixed build |
|---|---|---|---|
| CVE-2026-41940; cPanel advisory, April 28, 2026 | Authentication bypass in cPanel session handling; the reported attack could be unauthenticated. | CSA reported active exploitation and a public proof of concept. | Branch-specific floors are listed above; verify against the current vendor advisory. |
| CVE-2026-65643; cPanel advisory, August 27, 2026 | An authenticated account holder with domain privileges could create arbitrary files. | Root code execution impact was described in the advisory. | Not stated in the reviewed advisory summary; consult the current cPanel notice. |
| CVE-2026-67401; cPanel advisory, September 8, 2026 | An authenticated account holder with mail privileges could create arbitrary files through EmailTrack. | Root code execution impact was described in the advisory. | Not stated in the reviewed advisory summary; consult the current cPanel notice. |
| CVE-2026-58048; CSA alert | An authenticated database privilege escalation. | CSA said exploitation could grant database root privileges and, in shared hosting, expose or alter other customers’ databases. | Not stated in the CSA alert summary; check the relevant vendor update and confirm remediation with the hosting provider if applicable. |
The cPanel security index also listed advisories dated September 22 and September 29, 2026. The examples here are not a complete inventory. For each notice, check its CVE, affected component, authentication requirements, affected branch, fixed build, exploitation evidence, and vendor mitigation rather than treating “cPanel vulnerability” as a single issue.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
What does the reported patch-coverage figure mean?
On May 10, 2026, cPanel reported that over 98% of servers worldwide were running an updated version. This is cPanel’s snapshot for that date, not a current measurement and not evidence that any individual server was patched or uncompromised.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
