CVE-2026-41940 cPanel/WHM Authentication Bypass

[ADMIN]

CVE-2026-41940 cPanel/WHM Authentication Bypass

The Internet Is Falling Down, Falling Down, Falling Down (cPanel & WHM Authentication Bypass CVE-2026-41940)

Hello! Yes, it's all a disaster again! Let's get this party started: 0:00 /0:12 1× No comments today, so imagine this: * We wrote something that we find very funny, * Nobody else gets it, * But everyone humors us Just like a typical watchTowr...

labs.watchtowr.com

Exploit: https://github.com/watchtowrlabs/watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py

Affected Software:

• cPanel & WHM 11.110.0 versions prior to fixed version 11.110.0.97
• cPanel & WHM 11.118.0 versions prior to fixed version 11.118.0.63
• cPanel & WHM 11.126.0 versions prior to fixed version 11.126.0.54
• cPanel & WHM 11.132.0 versions prior to fixed version 11.132.0.29
• cPanel & WHM 11.134.0 versions prior to fixed version 11.134.0.20
• cPanel & WHM 11.136.0 versions prior to fixed version 11.136.0.5
• WP Squared 11.136.1 versions prior to fixed version 11.136.1.7

Query: https://www.shodan.io/search?query=http.favicon.hash:-696182543

- Запрос Shodan по потенциальным целям выдает около 1,5 миллиона экземпляров cPanel, открытых для доступа из Интернета, которые могут быть уязвимы.