CISA Warns of cPanel & WHM Vulnerability Exploited in Attacks

CISA warns of CVE-2026-41940, a critical CWE-306 authentication bypass in WebPros cPanel & WHM and WP2 that lets unauthenticated attackers directly obtain administrative access to hosting control panels; the vulnerability was added to CISA's KEV catalog with active exploitation reported and an urgent remediation deadline that has passed, so affected organizations are strongly urged to apply vendor patches or discontinue use immediately.