Critical Security Advisory: Addressing Authentication Bypass Vulnerabilities in cPanel & WHM

Web hosting administrators and systems engineers are advised to initiate emergency remediation protocols immediately. cPanel has released a high-priority security update designed to mitigate a critical vulnerability that fundamentally undermines the authentication integrity of the cPanel and WebHost Manager (WHM) ecosystem.

Disclosed on April 28, 2026, the flaw involves a breakdown in various authentication paths. Because control panels like cPanel function as the “central nervous system” of a web server—orchestrating everything from SMTP/IMAP routing to complex database management—they are high-value targets for sophisticated threat actors.

The technical implication of this vulnerability is severe: by exploiting these flaws in the authentication framework, an attacker could achieve an authentication bypass. This allows for unauthorized escalation to administrative privileges, granting the actor full control over the server environment. Once inside, the blast radius is significant, potentially leading to:

• Deployment of persistent malware or rootkits.
• Exfiltration of sensitive customer PII (Personally Identifiable Information) and encrypted credentials.
• The use of the compromised infrastructure to launch distributed attacks against third-party networks.

Given that the vulnerability resides deep within the core authentication logic, standard perimeter defenses may not be sufficient. Prompt patching is the only definitive method to close these entry points.

Scope of Impact: Affected cPanel Versions

The cPanel security team has confirmed that this vulnerability impacts all currently supported software iterations. To ensure infrastructure integrity, administrators must audit their current build versions and transition to a patched release immediately.

The official security patches have been integrated into the following software tiers:

• Version 11.110.0.97
• Version 11.118.0.63
• Version 11.126.0.54
• Version 11.132.0.29
• Version 11.134.0.20
• Version 11.136.0.5

Note on Legacy Systems: Servers running older, end-of-life (EOL) releases are inherently vulnerable. cPanel does not issue security patches for unsupported legacy builds; therefore, administrators managing legacy environments must prioritize a full migration to a supported version to mitigate risk.

Remediation and Deployment Strategy

To mitigate this risk, administrators should not wait for the standard maintenance window. Instead, a forced update should be executed via the command line to ensure the latest security binaries are pulled and applied immediately.

Log in to your server via SSH and execute the following command with root privileges:

/scripts/upcp --force

This command triggers the cPanel update script to bypass standard update schedules, effectively forcing the system to fetch and install the most recent, secure version of the software. Once the process completes, verify the update by checking the version number within the WHM Dashboard.

Post-Patch Auditing and Hardening

Patching the vulnerability is the first step, but it does not guarantee that a breach hasn’t already occurred. We recommend a “assume breach” mindset for the following post-remediation steps:

1. Log Analysis: Conduct a deep dive into server access logs. Scrutinize logs for anomalous authentication patterns, unexpected administrative logins, or the creation of unauthorized user accounts during the window of vulnerability.
2. Credential Rotation: If any suspicious activity is detected, consider a mandatory password reset for all administrative accounts.
3. Defense in Depth: Strengthen your security posture by enforcing Multi-Factor Authentication (MFA) for all WHM access.
4. Network Restricting: Implement IP whitelisting to restrict access to the WHM management port to known, trusted administrative IP addresses only.