cPanel Zero-Day CVE-2026-41940 Exploited for Months Before Patch Release

GLOBAL, April 30, 2026, 13:47 UTC

• A critical zero-day vulnerability in cPanel has been exploited since February 2026.
• The flaw allows authentication bypass, risking unauthorized control over hosting accounts.
• Patch released after months of active exploitation; immediate updates are essential.

Security researchers have confirmed that a severe authentication bypass vulnerability in cPanel, identified as CVE-2026-41940, has been actively exploited by threat actors for several months before a public patch was issued. The vulnerability enables attackers to bypass login controls and gain unauthorized access to web hosting accounts managed through cPanel.

cPanel is a widely used web-based control panel that allows users and hosting providers to manage websites, email accounts, and server configurations. Its prevalence in shared hosting environments means that a successful exploit can compromise numerous websites and services.

Researchers from watchTowr first publicly disclosed technical details of the flaw on April 29, 2026. However, evidence shows attackers were exploiting the vulnerability as early as February 23, 2026, and likely before that date. This extended window of exploitation before patch availability raises concerns about the scope of compromised accounts.

The vulnerability stems from an authentication bypass mechanism that attackers can leverage to access accounts without valid credentials. Once inside, attackers can manipulate website files, inject malicious code, or escalate privileges, potentially leading to data breaches or hosting infrastructure compromise.

cPanel issued a security advisory alongside the release of a patch that addresses CVE-2026-41940. The company emphasized the criticality of the update and urged all users and hosting providers to apply it immediately to block ongoing exploitation.

Shared hosting providers, who often manage multiple client accounts on a single server, are particularly at risk. An attacker compromising one account could pivot to others or disrupt multiple websites hosted on the same infrastructure.

Security analysts warn that organizations using cPanel should assume potential compromise if they did not apply mitigations before the patch release. Incident response measures, including reviewing access logs and resetting credentials, are recommended.

The delayed patch release following months of active exploitation highlights the challenges in detecting and mitigating zero-day vulnerabilities in widely deployed software. It also underscores the importance of proactive monitoring and rapid response capabilities within hosting environments.

Looking ahead, cPanel users should monitor for suspicious activity and ensure their hosting providers maintain timely patch management practices. Attackers may continue targeting unpatched systems or attempt to exploit related weaknesses.

Risk remains significant for websites relying on cPanel versions prior to the patch. Failure to update promptly could result in unauthorized access, website defacement, data theft, or use of compromised servers in broader cyberattacks.

In response to this incident, hosting providers and administrators should:

• Immediately apply the official cPanel patch addressing CVE-2026-41940.
• Audit user accounts and access logs for unusual login attempts or unauthorized changes.
• Reset passwords and API keys associated with cPanel accounts.
• Enhance monitoring for anomalous activity on hosting servers.

The cPanel zero-day exploitation case serves as a reminder of persistent threats facing web hosting platforms and the critical role of timely security updates in protecting internet infrastructure.

https://www.helpnetsecurity.com/2026/04/30/cpanel-zero-day-vulnerability-cve-2026-41940-exploited/