THE BASE COLLECTIONCRDS / 0.1

CVE-2026-41940CRITICAL

cPanel and WHM

KNOWN EXPLOITED

initial accessT1190

cPanel and its server manager (WHM) in releases after 11.40 let an unauthenticated attacker through the login flow, handing them the control panel that administers every site hosted on the server.

CVSS

9.3

EPSS

99%

PATCH

Vendor

Apply the cPanel security update of 28 April 2026 now; exploit code is public, so audit control panel logins and reset every account that could have been reached.

SCRTY:CRDS / BASE SETREV. 01 ◆

Raw JSON

One vulnerability. The facts that matter.
A clear next move.

critical Known exploitedREV. 01

CVE-2026-41940cPanel and WHM — login flow bypass to control panel access

cPanel and its server manager (WHM) in releases after 11.40 let an unauthenticated attacker through the login flow, handing them the control panel that administers every site hosted on the server.

YOUR NEXT MOVE

Apply the cPanel security update of 28 April 2026 now; exploit code is public, so audit control panel logins and reset every account that could have been reached.

Read the risk

THE VITAL STATS

CVSS score: 9.3/ 10
EPSS probability: 99%
Attack complexity: Low
Known exploited: Yes — CISA KEV
CVE published: 2026-04-29
Added to KEV: 2026-04-30
Exploit published: Yes
Confidence: high
Kill chain: initial access
MITRE ATT&CK: T1190
Severity: critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attacker needsNetwork access to the cPanel or server manager login page; no credentials needed.

Behind the card

5 REFERENCES

Field-level provenanceTRACE THE SOURCES +

Which source supports each field, when it was retrieved, and who extracted it.

Fields	Source	Retrieved	Extractor	Confidence
cvss, exploitation.attack_complexity, exploitation.exploit_available, references, published_at	nvd.nist.gov	2026-09-24	scrty-crds-pipeline/0.1	high
exploitation.known_exploited, exploitation.kev_added	cisa.gov	2026-09-24	scrty-crds-pipeline/0.1	high
epss	api.first.org	2026-09-24	scrty-crds-pipeline/0.1	high
title, summary, severity, remediation, mitre_attack, kill_chain, recommended_action, confidence, tags, exploitation.prerequisites	nvd.nist.gov	2026-09-24	claude-code	high

Printing history

THE RECORD

r12026-09-24Initial base card

First printing. This card has not been reprinted since publication.