CISA Alert Highlights Active Exploitation of cPanel & WHM Security Bug

CISA has added CVE-2026-41940 — a critical missing-authentication/authentication bypass flaw in WebPros cPanel & WHM and WP2 — to its KEV catalog, confirming active exploitation in the wild. The vulnerability allows remote attackers to bypass the login flow and obtain full administrative access to hosting control panels, posing a high risk of server compromise, data theft, and widespread abuse; CISA required federal agencies to remediate under BOD 22-01 and strongly urges immediate patching or discontinuation of affected products.