# Authentication bypass in cPanel

**URL:** <https://forum.virtualmin.com/t/authentication-bypass-in-cpanel/137139>\
**Category:** Third Party News\
**Created:** [April 30, 2026, 2:39am UTC](https://forum.virtualmin.com/t/authentication-bypass-in-cpanel/137139 "2026-04-30T02:39:36Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Joe](https://cdn.forum.virtualmin.com/user_avatar/forum.virtualmin.com/joe/32/9_2.png) [@Joe](https://forum.virtualmin.com/u/Joe)\
**Post date:** [April 30, 2026, 2:39am UTC](https://forum.virtualmin.com/t/authentication-bypass-in-cpanel/137139/1 "2026-04-30T02:39:36Z")

</div>

I usually wouldn’t post cPanel news, but this came across my feed and I know there are some folks here who use both Virtualmin and cPanel…and this is pretty serious and needs urgent attention. If you’ve got cPanel systems, update them now.

[https://support.cpanel.net/hc/en-us/articles/40073787579671-Security-CVE-2026-41940-cPanel-WHM-WP2-Security-Update-04-28-2026](https://support.cpanel.net/hc/en-us/articles/40073787579671-Security-CVE-2026-41940-cPanel-WHM-WP2-Security-Update-04-28-2026)

---

<div class="post-metadata">

**Author:** ![ID10T](https://cdn.forum.virtualmin.com/user_avatar/forum.virtualmin.com/id10t/32/7895_2.png) [@ID10T](https://forum.virtualmin.com/u/ID10T)\
**Post date:** [May 1, 2026, 6:05pm UTC](https://forum.virtualmin.com/t/authentication-bypass-in-cpanel/137139/2 "2026-05-01T18:05:44Z")

</div>

“One web hosting company says it found evidence that hackers have been abusing the vulnerability for months before the attempts were discovered.”  
From article on Slashdot. So you may have some investigating ahead of you. ☹  
(Slightly off topic? I just blocked a /24 listed as being in Tehran yesterday. Not sure if the timing is coincidental here.)

> **[Hackers Are Actively Exploiting a Bug In cPanel, Used By Millions of Websites...](https://it.slashdot.org/story/26/05/01/0631257/hackers-are-actively-exploiting-a-bug-in-cpanel-used-by-millions-of-websites)**
>
> Hackers are actively exploiting a critical cPanel and WHM vulnerability, tracked as CVE-2026-41940, that allows remote attackers to bypass the login screen and gain full administrative access to affected web servers. Major hosts including Namecheap,...

---

<div class="post-metadata">

**Author:** ![system](https://cdn.forum.virtualmin.com/uploads/default/original/2X/c/cd96d761e326db4b2bef94886a639109bd7a8e76.svg) [@system](https://forum.virtualmin.com/u/system)\
**Post date:** [May 21, 2026, 6:06pm UTC](https://forum.virtualmin.com/t/authentication-bypass-in-cpanel/137139/3 "2026-05-21T18:06:04Z")

</div>

Closed on May 21, 2026, 6:06pm UTC

This topic was automatically closed 20 days after the last reply. New replies are no longer allowed.