This vulnerability (CVE-2026-41940) affects multiple versions of WebPros cPanel and WHM starting from version 11.40. It involves a missing authentication check on a critical function, enabling unauthenticated remote attackers to bypass authentication controls and access the control panel without valid credentials. The CVSS 4.0 base score of 9.3 reflects the critical nature of this flaw, with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No official remediation or patch has been documented as of the published date.

Successful exploitation of this vulnerability would allow an unauthenticated attacker to gain unauthorized access to the cPanel control panel, potentially leading to full compromise of the affected system. This could result in unauthorized administrative actions, data exposure, and disruption of services. However, no known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation guidance is currently documented, organizations should monitor WebPros advisories closely for updates. Until a fix is available, consider restricting network access to the cPanel interface to trusted IPs and implementing additional network-level protections to reduce exposure.