Urgent security warning in Canada about a serious vulnerability targeting cPanel and WHM

Ottawa —
The Canadian Centre for Cyber Security has issued an urgent warning about a serious security vulnerability affecting cPanel and WebHost Manager hosting management systems, warning of the potential for widespread exploitation.

The warning explained that the vulnerability, classified under the code CVE-2026-41940, is due to the absence of an authentication mechanism in sensitive functions, allowing attackers to access management interfaces without the need for login credentials.

It pointed out that exploiting this vulnerability could enable attackers to take control of hosted websites, databases, and email accounts, as well as modify server settings, with the potential to affect thousands of sites linked to shared hosting servers.

The centre confirmed that the likelihood of exploiting the vulnerability is high, urging organizations to take immediate action to mitigate risks.

Recommendations include updating systems to the patched versions released by the developing company, restricting access to management interfaces over networks, and reviewing login logs to detect any unusual activity.

It also emphasized the importance of strengthening cybersecurity measures, including regularly updating systems, managing user permissions, and securing internet-connected applications.

The centre called on organizations to report any suspicious activity related to the vulnerability, as part of efforts to reduce the risks of potential cyberattacks.