A critical vulnerability affecting all but the latest versions of cPanel and the WebHost Manager (WHM) dashboard could be exploited to obtain access to the control panel without authentication.
The security issue, currently identified as CVE-2026-41940 and with a severity score of 9.8, has been addressed in an emergency update that requires running a command manually to retrieve a patched version of the software.
Owned by WebPros International, WHM and cPanel are Linux-based web hosting control panels for server and website management. While WHM provides server-level control, cPanel provides administrator access to the website backend, webmail, and databases.
Both products are among the most widely deployed hosting control panels, popular with many hosting providers for their standardized interfaces, ease of use for non-technical users, and deep integration with common hosting stacks.
No technical details have been publicly disclosed, but the severity of the issue appears significant, as Namecheap temporarily blocked access to ports 2083 and 2087 used for WHM and cPanel to protect customers until patches were available.
"We regret to inform you that a critical security vulnerability has been identified in cPanel software affecting all currently supported versions," Namecheap said.
The hosting provider stated that the vulnerability "relates to an authentication login exploit that could allow unauthorized access to the control panel.”
A few hours after Namecheap's notification, cPanel published a security bulletin informing that the security issue had been addressed in the following product versions:
11.110.0.97
11.118.0.63
11.126.0.54
11.132.0.29
11.136.0.5
11.134.0.20
To install a safe version, the vendor recommends that administrators execute the command /scripts/upcp –force, which runs the cPanel update process and forces it to execute even if the system thinks it already runs on the latest version.
Servers running an unsupported version of cPanel are ineligible for security updates. In this case, administrators are recommended to upgrade to a supported version as soon as possible.
An attacker gaining access to cPanel can control everything present in the hosting account, from websites and data to email. They can use the access to plant backdoors or web shells, redirect users to malicious locations, steal sensitive files, send spam or phishing emails, or collect passwords from configuration files.
WHM provides access to the entire server and all the websites it hosts. This means that a threat actor could create and delete cPanel accounts, establish persistent access on the machine, and use it for various malicious activities (e.g., proxy traffic, spam, malware delivery, botnet).
Website owners using the affected management interfaces should ensure that they have updated to a patched version.