TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

Imperva Blog

Imperva Customers Protected Against CVE-2026-41940 in cPanel & WHM

Gabi Sharadin · 6 days ago · Read original ↗

ATT&CK techniques detected

3 predictions
T1190Exploit Public-Facing Application
96%
“the most frequently targeted industries were business, society, and education. this distribution reflects the broad deployment of hosting control panels across organizations that maintain public - facing websites, portals, and distributed web infrastructure. while observed volume…”
T1190Exploit Public-Facing Application
52%
“behavior. cpanel has released patched versions and recommends immediate updates. administrators should update a fixed version, verify the cpanel build, and restart the cpanel service. for environments that cannot immediately patch, cpanel recommends blocking inbound traffic on po…”
T1588.006Vulnerabilities
42%
“behavior. cpanel has released patched versions and recommends immediate updates. administrators should update a fixed version, verify the cpanel build, and restart the cpanel service. for environments that cannot immediately patch, cpanel recommends blocking inbound traffic on po…”

Summary

What is CVE-2026-41940? CVE-2026-41940 is a critical authentication bypass vulnerability affecting cPanel & WHM, including DNSOnly, in versions after 11.40. The flaw, discovered by WatchTowr Labs, exists in the login flow and allows unauthenticated remote attackers to gain unauthorized access to the control panel. The vulnerability carries a CVSS 3.1 score of 9.8 and is […]

The post Imperva Customers Protected Against CVE-2026-41940 in cPanel & WHM appeared first on Blog.