CVE-2026-41940 is an authentication-bypass flaw in the login flow of WebPros cPanel & WHM (and its bundled WP2/WordPress Squared component) that lets a remote, unauthenticated attacker gain unauthorized control-panel access; it was mass-exploited within days of disclosure to deploy the Go-based "Sorry" ransomware, with Shadowserver reporting at least 44,000 compromised cPanel IP addresses, and CISA's KEV catalog records known ransomware-campaign use.
Vulnerability summary
9.8
Critical
98.5%
EPSS score (FIRST)
Yes
CISA KEV catalog
2026-04-29
Published
Vulnerability ID: CVE-2026-41940 · Source: VulnCheck (not NVD-confirmed)
Affected components
| Component | CPE | Version range |
|---|---|---|
| cPanel | cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:* | 11.40 through 86.0.40 (fixed 86.0.41); 88.0.0-110.0.96 (fixed 110.0.97); 112.0.0-118.0.62 (fixed 118.0.63); 120.0.0-124.0.34 (fixed 124.0.35); 126.0.1-126.0.53 (fixed 126.0.54); 128.0.0-130.0.18 (fixed 130.0.19); 132.0.0-132.0.28 (fixed 132.0.29); 134.0.0-134.0.19 (fixed 134.0.20); 136.0.0-136.0.4 (fixed 136.0.5) |
| WHM (WebHost Manager) | cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:* | same per-branch ranges as cPanel above: 11.40 through 136.0.4 across nine branch releases, each fixed at the next listed build |
| WP2 (WordPress Squared) | cpe:2.3:a:cpanel:wp_squared:*:*:*:*:*:wordpress:*:* | before 136.1.7, fixed in 136.1.7 |
What this means
CVE-2026-41940 is a missing-authentication-for-critical-function vulnerability (CWE-306) in WebPros cPanel & WHM. NVD's description states: "cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel" (NVD).
NVD lists only a Secondary CVSS v3.1 score from source [email protected]: base score 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. NVD's status is "Analyzed," but no NVD Primary CVSS metric has been published, so this score is labelled not NVD-confirmed on this page (NVD).
VulnCheck's own advisory, the disclosing source, separately rates the issue CVSS v4.0 9.3 (critical, vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N), confirms the CWE-306 classification, and lists the issue as included in VulnCheck's own KEV feed as actively exploited (VulnCheck).
Exploitation escalated fast and at scale: BleepingComputer reported that a Go-based Linux ransomware strain nicknamed "Sorry" — which appends a .sorry extension and encrypts files with ChaCha20 under an embedded RSA-2048 public key — began mass-exploiting the flaw, with security-research group Shadowserver finding "at least 44,000 IP addresses running cPanel" already compromised in ongoing attacks; the same report notes exploitation attempts had been observed as early as late February 2026, ahead of the public disclosure and emergency patch (BleepingComputer).
CISA added CVE-2026-41940 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-04-30, with a required-action due date of 2026-05-03 — three days later — and records known ransomware-campaign use as "Known." Catalog version 2026.10.28, 1,762 entries, confirmed live this run (CISA KEV).
As of 2026-10-28, FIRST scores the probability of exploitation at 0.98527 (99.921st percentile) — one of the highest EPSS scores in this round, consistent with an unauthenticated control-panel bypass that was mass-exploited for ransomware within days of disclosure (FIRST EPSS).
Any cPanel & WHM install on the affected branches above (11.40 through 136.0.4, fixed at the corresponding next build in each branch) should be patched immediately, and any WP2/WordPress Squared component should be upgraded to 136.1.7 or later; given the documented mass ransomware exploitation, hosting operators should also check for signs of prior compromise rather than treating patching alone as sufficient.
Evidence
- Authentication bypass in the cPanel & WHM login flow (CWE-306), present in versions after 11.40, allowing unauthenticated remote attackers to gain unauthorized control-panel access. — NVD
- NVD lists only a Secondary CVSS v3.1 score of 9.8 (critical) from source [email protected], vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; no NVD Primary metric is published, so the score is not NVD-confirmed. — NVD
- VulnCheck, the disclosing source, separately scores the issue CVSS v4.0 9.3 and lists it as actively exploited in its own KEV feed. — VulnCheck
- The Go-based "Sorry" ransomware (ChaCha20 encryption under an embedded RSA-2048 key, .sorry file extension) mass-exploited this flaw; Shadowserver found at least 44,000 compromised cPanel IP addresses, with exploitation attempts dating to late February 2026. — BleepingComputer
- Added to the CISA KEV catalog on 2026-04-30, required-action due date 2026-05-03, known ransomware campaign use recorded as Known. Catalog version 2026.10.28, 1,762 entries, confirmed live this run. — CISA KEV
- EPSS score is 0.98527 (99.921st percentile) as of 2026-10-28. — FIRST EPSS
