All supported cPanel versions hit by critical auth bug, now patched

Pierluigi Paganini
April 29, 2026

cPanel fixed a critical authentication flaw that could let attackers access servers. The issue affects all supported versions.

cPanel released security updates to address a critical authentication vulnerability that could allow attackers to gain unauthorized access to its control panel. The flaw affects all supported versions, raising serious risks for exposed servers.

cPanel is a widely used web hosting control panel that lets users manage websites and servers through a graphical interface instead of command-line tools.

The company has patched the issue in updated releases and urges administrators to apply updates immediately to reduce the risk of compromise.

Namecheap applied a temporary firewall rule blocking TCP ports 2083 and 2087, limiting access to cPanel and WHM until a full patch is released. The company warns that the mitigation may block access to cPanel and WHM and disrupt Webmail, Webdisk, and both SSL and non-SSL connections during this period.

“We regret to inform you that a critical security vulnerability has been identified in cPanel software affecting all currently supported versions. This vulnerability relates to an authentication login exploit that could allow unauthorized access to the control panel.” reads the advisory. “The fix has been successfully applied to all the remaining servers as well.”

The following versions address the vulnerability:

• 11.110.0.97
• 11.118.0.63
• 11.126.0.54
• 11.132.0.29
• 11.136.0.5
• 11.134.0.20

“If your server is not running a supported version of cPanel that is eligible for this update, it is highly recommended that you work toward updating your server as soon as possible, as it may also be affected,” cPanel noted.

As of April 29, 2026, 02:42 a.m. UTC, the fix has been deployed across Reseller, Stellar Business, and other servers, according to the Namecheap Support Team.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon