CISA hat am 30.04.2026 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 03.05.2026.
Erforderliche Maßnahme: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026 ; https://docs.cpanel.net/release-notes/release-notes/ ; https://docs.wpsquared.com/changelogs/versions/changelog/#13617 ; https://nvd.nist.gov/vuln/detail/CVE-2026-41940"
cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| cpanel | cpanel | 11.40.0.0 – < 11.86.0.41 | |
| cpanel | whm | 11.40.0.0 – < 11.86.0.41 | |
| cpanel | wp squared | < 136.1.7 | |
| WebPros | cPanel | 11.40.0.0 – < 11.86.0.41, 11.88.0.0 – < 11.94.0.28, 11.96.0.0 – < 11.102.0.39, 11.104.0.0 – < 11.110.0.97, 11.112.0.0 – < 11.118.0.63, 11.120.0.0 – < 11.124.0.35, 11.126.0.0 – < 11.126.0.54, 11.128.0.0 – < 11.130.0.19, 11.132.0.0 – < 11.132.0.29, 11.134.0.0 – < 11.134.0.20, 11.136.0.0 – < 11.136.0.5 | |
| WebPros | WHM | 11.40.0.0 – < 11.86.0.41, 11.88.0.0 – < 11.94.0.28, 11.96.0.0 – < 11.102.0.39, 11.104.0.0 – < 11.110.0.97, 11.112.0.0 – < 11.118.0.63, 11.120.0.0 – < 11.124.0.35, 11.126.0.0 – < 11.126.0.54, 11.128.0.0 – < 11.130.0.19, 11.132.0.0 – < 11.132.0.29, 11.134.0.0 – < 11.134.0.20, 11.136.0.0 – < 11.136.0.5 | |
| WebPros | WP Squared | < 11.136.1.7 |
cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:* ≥ 11.40 < 86.0.41cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:* ≥ 88.0.0 < 110.0.97cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:* ≥ 112.0.0 < 118.0.63cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:* ≥ 120.0.0 < 124.0.35cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:* ≥ 126.0.1 < 126.0.54cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:* ≥ 128.0.0 < 130.0.19cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:* ≥ 132.0.0 < 132.0.29cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:* ≥ 134.0.0 < 134.0.20cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:* ≥ 136.0.0 < 136.0.5cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:* ≥ 11.40 < 86.0.41cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:* ≥ 88.0.0 < 110.0.97cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:* ≥ 112.0.0 < 118.0.63cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:* ≥ 120.0.0 < 124.0.35cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:* ≥ 126.0.1 < 126.0.54cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:* ≥ 128.0.0 < 130.0.19cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:* ≥ 132.0.0 < 132.0.29cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:* ≥ 134.0.0 < 134.0.20cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:* ≥ 136.0.0 < 136.0.5cpe:2.3:a:cpanel:wp_squared:*:*:*:*:*:wordpress:*:* < 136.1.7Unser kostenloser Open-Source-Honeypot wartet auf Ports, die Ihr Server nicht nutzt, und meldet verbindende Scanner und Angreifer an eine gemeinsame Blockliste.