CVE-2026-41940 Exploited Shortly After Public Disclosure
CVE-2026-41940, an authentication bypass in cPanel, was exploited shortly after its disclosure. CrowdStrike observed widespread exploitation starting April 30, 2026.
OffSet7 Newsroom · Reviewed by an OffSet7 analyst · AI-assisted
What happened
CVE-2026-41940, an authentication bypass vulnerability in cPanel, was exploited.
Who is affected
cPanel
Exploited
CrowdStrike began to observe widespread exploitation of CVE-2026-41940.
What to do
A technical blog provided exploitation guidance.
CrowdStrike has confirmed the widespread exploitation of CVE-2026-41940, an authentication bypass vulnerability in cPanel. The vulnerability was disclosed on April 28, 2026, and exploitation began on April 30, 2026.
A technical blog published on April 29, 2026, provided exploitation guidance for CVE-2026-41940. Attackers modified a purported detection-artifact generator to exploit CVE-2026-41940.
CrowdStrike noted that 91% of vulnerabilities with public POC code were exploited within 48 hours. The publication of POC code is often treated as a 'starting gun' for attackers, who use public vulnerability research as a basis for launching attacks. This dual nature of vulnerability research presents both opportunities and challenges for the security community.
