{"id":12592,"date":"2026-05-04T10:03:44","date_gmt":"2026-05-04T10:03:44","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/05\/04\/cisa-warns-of-cpanel-whm-vulnerability-exploited-in-attacks\/"},"modified":"2026-05-04T10:03:44","modified_gmt":"2026-05-04T10:03:44","slug":"cisa-warns-of-cpanel-whm-vulnerability-exploited-in-attacks","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/05\/04\/cisa-warns-of-cpanel-whm-vulnerability-exploited-in-attacks\/","title":{"rendered":"CISA Warns of cPanel & WHM Vulnerability Exploited in Attacks"},"content":{"rendered":"\n
CISA Warns of cPanel & WHM Vulnerability Exploited in Attacks<\/div>\n

\t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning regarding a critical security flaw affecting widely used web hosting management platforms.<\/p>\n

CISA recently added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, indicating that threat actors are actively abusing it in real-world attacks.<\/p>\n

Tracked as CVE-2026-41940<\/a>, the defect targets WebPros cPanel & WHM (WebHost Manager) as well as WP2 (WordPress Squared).<\/p>\n

Understanding the Authentication Bypass Flaw<\/strong><\/h2>\n

CVE-2026-41940 is officially classified as a \u201cMissing Authentication for Critical Function\u201d vulnerability, mapped to the weakness identifier CWE-306.<\/p>\n

The security gap exists directly within the login flow of the affected products.<\/p>\n

Because the software fails to properly verify user identities during the authentication process, unauthenticated remote attackers can bypass security checks completely.<\/p>\n

This means a cybercriminal does not need valid usernames or passwords to break in.<\/p>\n

Instead, they can exploit the login mechanism<\/a> to instantly gain unauthorized administrative access to the hosting control panel.<\/p>\n

WebPros cPanel & WHM is a popular suite that simplifies website and server management, while WP2 provides streamlined WordPress operations.<\/p>\n

Control panels are highly attractive targets for attackers because they serve as the administrative backbone for thousands of websites, databases, and server configurations.<\/p>\n

The widespread adoption of these tools means a single flaw can expose countless domains to immediate compromise.<\/p>\n

Once an attacker bypasses the login screen, they effectively hold the keys to the kingdom.<\/p>\n

They can modify website files, steal sensitive database information, reroute web traffic, or establish persistent backdoors for future access.<\/p>\n

While CISA notes that it is currently unknown if this specific vulnerability is tied to ongoing ransomware campaigns, the risk remains severe.<\/p>\n

Compromised hosting environments are frequently weaponized<\/a> to host phishing pages, run cryptomining scripts, or launch coordinated attacks against other networks.<\/p>\n

Required Mitigations and Deadlines<\/strong><\/h2>\n

To counter this active threat, CISA mandates immediate action from federal agencies, and private organizations are strongly encouraged to adopt the same protective measures.<\/p>\n

Security teams and system administrators should prioritize the following steps:<\/p>\n