U.S. CISA Adds Known Exploited Vulnerability to Catalog

| 2026-05-03 14:39 CRITICAL HIGH

JSON

Executive Summary AI-generated

The US Cybersecurity and Infrastructure Security Agency (CISA) has added a flaw in WebPros cPanel to its Known Exploited Vulnerabilities catalog, which affects all supported versions of the software. The vulnerability, tracked as CVE-2026-41940, carries a near-worst-case CVSS score of 9.8 and is attributed to an unknown entity. This incident marks one of several recent examples of in-the-wild exploitation against cPanel, with thousands of instances potentially exposed. As a result, CISA has issued a directive for federal agencies to fix the vulnerability by May 3, 2026.

Technical Mitigations AI-generated

* Implement secure login mechanisms: Ensure that all users have strong, unique passwords and use multi-factor authentication whenever possible. This can help prevent attackers from gaining unauthorized access to the cPanel or WHM. * Regularly update and patch software: Keep your hosting stack up-to-date with the latest security patches, including Microsoft Defender for WebPros cPanel. Regular updates can help fix known vulnerabilities before they are exploited by attackers. * Use a web application firewall (WAF): Consider installing a WAF like ModSecurity or OWASP ZAP to detect and prevent common web attacks, such as SQL injection and cross-site scripting (XSS). * Implement rate limiting: Limit the number of login attempts from each IP address within a certain time frame. This can help prevent attackers from exploiting multiple accounts by trying different combinations of credentials. * Monitor for suspicious activity: Regularly monitor your hosting stack's logs and system performance to detect any unusual activity that may indicate an attack in progress.

Intelligence Metadata

Actors / Malware / CVEs / Campaigns

CVE-2026-41940

Target & Sectors

NORTH_AMERICA

Incident Timeline

‎late February 2026

Threat actors exploited a critical cPanel vulnerability to target and patch hosting providers including KnownHost and HostGator.

Click on any entity below to view its context and source!

organisation KnownHost

Hosting providers including Namecheap , HostGator, and KnownHost temporarily blocked access to cPanel interfaces while patching, treating this as a critical authentication bypass and reporting exploit attempts going back to late February 2026.

Malware Bytes

organisation HostGator

Malware Bytes

‎April 28, 2026

The cPanel release of patches on April 28, 2026, was prompted by a critical vulnerability in the software.

‎May 3, 2026

Threat actors exploited a critical cPanel vulnerability to gain unauthorized access and compromise millions of websites.

‎2026/05/03

The attackers used a critical cPanel vuln to target millions of sites.

Click on any entity below to view its context and source!

infrastructure 11.40

“Therefore, we’re releasing our Detection Artifact Generator to enable defenders to identify vulnerable hosts in their estates.” CVE-2026-41940 is an authentication bypass flaw affecting cPanel and WHM versions after 11.40.

Security Affairs

The vulnerability, tracked as CVE-2026-41940 , carries a near-worst-case CVSS score of 9.8 and affects all supported versions of cPanel and Web[Host Manager (WHM) released after version 11.40, along with WP Squared, a WordPress management layer built on top of the same platform.

The Register - Cybercrime

It said all supported versions after 11.40 are affected, including DNSOnly and WP Squared.

Malware Bytes

organisation WHM

Security Affairs

The Register - Cybercrime

Security researchers are warning about a newly discovered vulnerability in the widely used web server management software cPanel and WebHost Manager (WHM).

Malware Bytes

infrastructure 9.8

The Register - Cybercrime

organisation CVSS

The Register - Cybercrime

organisation WP Squared

The Register - Cybercrime

It said all supported versions after 11.40 are affected, including DNSOnly and WP Squared.

Malware Bytes

organisation WordPress

The Register - Cybercrime

organisation WebHost

Security researchers are warning about a newly discovered vulnerability in the widely used web server management software cPanel and WebHost Manager (WHM).

Malware Bytes

organisation cPanel

cPanel is a widely used web hosting control panel that lets users manage websites and servers through a graphical interface instead of command-line tools.

Security Affairs

First reports come in of victims of critical cPanel vuln as 'millions' of sites potentially exposed.

The Register - Cybercrime

Actively exploited cPanel bug exposes millions of websites to takeover.

Malware Bytes

organisation KnownHost

“As we stated above, in-the-wild exploitation has already begun, according to KnownHost.”

Security Affairs

Hosting provider KnownHost has been more explicit about what that looked like in practice, warning customers it had seen successful exploitation attempts before any fix was available.

The Register - Cybercrime

organisation the Shadowserver Foundation

According to the Shadowserver Foundation, thousands of instances may be exposed.

Security Affairs

financial $7,000 attackers

The attackers, they said, demanded $7,000 to unlock systems.

The Register - Cybercrime

organisation cPanel/WHM

This is a critical, actively exploited authentication-bypass bug in cPanel/WHM that lets attackers gain administrative access to the interface without credentials, potentially take over servers and all hosted sites.

Malware Bytes

organisation multi‑account

When one site is compromised, having the same credentials in several places turns it into a multi‑account takeover problem.

Malware Bytes

organisation FIDO2

If you can, use a FIDO2-compliant hardware key, laptop, or phone as your second factor.

Malware Bytes

organisation Digital Footprint

Use Malwarebytes’ free Digital Footprint scan to see whether your personal information has been exposed online.

Malware Bytes