ASD's ACSC said in a 1 May 2026 critical alert that it is 'aware of active exploitation in Australia of a critical vulnerability (CVE-2026-41940) affecting cPanel/WHM products', according to Cyber Daily (4 May). The CVE record (NVD) describes it as an authentication bypass in cPanel and WHM versions after 11.40 that allows unauthenticated remote attackers to gain unauthorized access to the control panel. cPanel says it released security updates for cPanel & WHM on 28 April 2026.

Correction (23 Oct 2026): this card earlier also cited a mistyped CVE number (the final 0 dropped), which belongs to an unrelated D-Link NAS flaw; the cPanel/WHM issue is CVE-2026-41940.

Correction (23 Oct 2026): removed a line saying the ACSC noted patches as of 30 April 2026, which rested only on an ASD page we cannot recheck; the ACSC alert is now credited to Cyber Daily.

Correction (26 Oct 2026): the mistyped number is no longer written out, so the page no longer links it.

Correction (26 Oct 2026): removed the 9.3 (CVSS 4.0) score and vector, which this card credited to the CVE record but which no source Cyberstack can read gives independently. cPanel's post of 10 May 2026 says the flaw affects every version of cPanel & WHM after 11.40 and WP Squared up to 11.136.1.6, and that CISA added it to its Known Exploited Vulnerabilities catalog on 1 May 2026. (source: cPanel blog — CVE-2026-41940: Response, Actions and Next Steps)