CVE-2026-41940: CRITICAL (CVSS 9.8), Actively Exploited (CISA KEV)

CRITICAL (CVSS 9.8), Actively Exploited (CISA KEV), EPSS 98.1%. cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.