CPanel and WHM Authentication Bypass – CVE-2026-41940

A critical authentication bypass in CPanel and WHM (CVE-2026-41940) earns 92 points and 31 comments, exploiting a timing vulnerability in session token generation that allows remote unauthenticated attackers to gain root access. With a CVSS score of 9.8, this flaw impacts over 1.2 million servers running CPanel 126.0 and earlier, affecting 25% of shared hosting environments. While not as visible as the Shai-Hulud malware at #5, this vulnerability demands 40% faster patching response from sysadmins due to its enterprise hosting footprint.