CVE-2026-41940 — CVE & Security Advisory Radar

🎯 CVE-2026-41940 CRITICAL 9.3 🔥 EPSS 97.9% ⚠️ CISA KEV · 126 T 🔓 Exploited 🇪🇺 EUVD

📄 .md Alle CVEs anzeigen ✕

CVE-2026-41940 | cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

Klassifikation & Betroffenheit:

WebPros cPanel 11.136.0.0 <11.136.0.5cPanel 11.126.0.0 <11.126.0.54WHM 11.132.0.0 <11.132.0.29cPanel 11.104.0.0 <11.110.0.97WHM 11.136.0.0 <11.136.0.5cPanel 11.134.0.0 <11.134.0.20WHM 11.126.0.0 <11.126.0.54WHM 11.120.0.0 <11.124.0.35

Improper Authentication 🎯 High

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

🛡️ Empfohlene Mitigation: Use an authentication framework or library such as the OWASP ESAPI Authentication feature.

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-22 · Exploiting Trust in Client (High) CAPEC-57 · Utilizing REST's Trust in the System Res… (Very High) CAPEC-114 · Authentication Abuse (Medium) CAPEC-115 · Authentication Bypass (Medium) CAPEC-151 · Identity Spoofing (Medium) CAPEC-194 · Fake the Source of Data (Medium) CAPEC-593 · Session Hijacking (Very High) CAPEC-633 · Token Impersonation (Medium)

🎯 ATT&CK-Techniken (Kill-Chain-Verhalten):

T1040 · Network Sniffing T1548 · Abuse Elevation Control Mechanism T1185 · Browser Session Hijacking T1550.001 · Use Alternate Authentication Mater… T1563 · Remote Service Session Hijacking T1134 · Access Token Manipulation

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2026-64637 9.9 CVE-2026-58046 9.9 CVE-2026-56843 9.9 CVE-2026-48614 9.9 CVE-2026-47365 9.9

🧪 Exploit-Evidenz: EDB-52574 · cPanel - CRLF Injection

🐙 Sachinart/CVE-2026-41940-cpanel- 🐙 debugactiveprocess/cPanel-WHM-Au 🐙 adriyansyah-mf/cve-2026-41940-po 🐙 Kagantua/cPanelWHM-AuthBypass 🐙 Wesuiliye/CVE-2026-41940

📰 Eigene Berichterstattung: ➔ CVE-2026-41940 — Updated! ➔ CVE-2026-41940 — Updated! ➔ CVE-2026-41940 — Updated! ➔ CVE-2026-41940 — Updated!

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

Ausnutzungs-Zeitleiste:

Reserviert 2026

Veröffentlicht 04/2026

Im KEV seit 04/2026

Heute 03.09.

CVSS-Vektor-Analyse: 9.3

AV · Angriffsvektor Netzwerk

AC · Komplexität Gering

PR · Privilegien Keine

UI · Interaktion Keine

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Veröffentlicht:29.04.2026

Aktualisiert:17.06.2026 10:47

Assigner (CNA):VulnCheck

EUVD-ID:EUVD-2026-26246

Quellen: 🇪🇺 EUVD-Datenbank (ENISA) + 🇺🇸 NVD-Anreicherung · 24-h-Cache

CWE-287: Improper Authentication ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

Tier	2026-08-29	2026-09-02
≥90 %	4	0
≥50 %	4	0
≥10 %	3	0
<10 %	304	300

9.3 CRITICAL

🇪🇺 EUVD ⚠️ KEV

EPSS

97.9%

CVE-2026-41940 🌐 Netzwerk (Remote) 🔓 Keine Authentifizierung nötig

🔓 WebPros

CVE-2026-41940 | cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

CWE-287: Improper Authentication ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

29.04.2026

🛡️ Details ➔

CVE-2026-41940 | cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

Zero-Day & Vulnerability Intelligence Hub

CVE-2026-41940 | cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.