VULNERABILITY 🔴 2×KEV
CVE-2026-41940 in cPanel/WHM: Actively Exploited RCE Added to CISA KEV Catalog
- CVE-2026-41940 is a critical vulnerability, reportedly enabling Remote Code Execution (RCE) in cPanel and WHM. Some reports also link it to Google Gemini CLI.
- CONFIRMED: The vulnerability is under active exploitation as a zero-day and has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. A public Proof-of-Concept (PoC) is available.
- Immediate action required: Patch all affected cPanel and WHM installations. Restrict administrative interface access to trusted IPs as a temporary mitigation.
Technical Analysis
Technical analysis indicates CVE-2026-41940 is a vulnerability class enabling unauthenticated Remote Code Execution. Sources have CONFIRMED its exploitation as a zero-day against publicly-facing cPanel and WHM servers. The attack vector allows an adversary to execute arbitrary code on the underlying system, leading to a full compromise. The public release of a Proof-of-Concept (PoC) exploit has significantly lowered the technical barrier for widespread attacks.
There is conflicting intelligence regarding the full scope of affected products. While cPanel and WHM are the primary targets of observed exploitation, the official CVE vendor is listed as Google, and some security reporting associates this event with a separate CVSS 10.0 RCE in Google's Gemini CLI. This discrepancy suggests the vulnerability may reside in a shared library or underlying component. While NVD has not yet published a CVSS score, field reports cite scores of 9.8 and 10.0, consistent with an unauthenticated RCE.
Affected Systems
- cPanel
- WHM
- Reportedly Google Gemini CLI CI
Intelligence Context
The addition of CVE-2026-41940 to the CISA KEV catalog on April 30, 2026, is the definitive signal for immediate defender action. This confirms active, in-the-wild exploitation. The 'ZERO-DAY RACE' designation indicates attackers had pre-disclosure access, placing defenders in a reactive posture. The high EPSS score (0.1652), placing it in the 95th percentile of all CVEs for exploitability, reinforces the KEV status and provides a clear, data-driven mandate for maximum prioritization. The availability of a public PoC accelerates the threat from targeted attacks to widespread, opportunistic scanning. Ambiguity regarding the vendor and full product scope should not delay patching of confirmed affected systems.
Remediation & Defense
- Restrict network access to cPanel, WHM, and Webmail services (ports 2083, 2087, 2096) to trusted IP addresses only.
- If patching is not immediately possible, review web server logs for anomalous requests and process execution.
- Monitor web server access logs for unusual POST requests to cPanel/WHM endpoints from unknown IP addresses.
- Monitor for unexpected child processes spawned by the web server's user account (e.g., `nobody`, `www-data`).
Source Timeline
- portal.auscert.org.au — First reporter
- bleepingcomputer.com — Technical confirmation and zero-day reporting
- thehackernews.com — Corroborating report
- cisa.gov — KEV catalog addition