U.S. CISA adds a flaw in WebPros cPanel to its Known Exploited Vulnerabilities catalog


U.S. CISA adds a flaw in WebPros cPanel to its Known Exploited Vulnerabilities catalog

Pierluigi Paganini
May 03, 2026

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a flaw in WebPros cPanel to its Known Exploited Vulnerabilities catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a flaw in Microsoft Defender, tracked as CVE-2026-41940 (CVSS score of 9.3), to its Known Exploited Vulnerabilities (KEV) catalog.

cPanel is a widely used web hosting control panel that lets users manage websites and servers through a graphical interface instead of command-line tools.

Cybersecurity experts at watchTowr first disclosed the flaw earlier this week and released a tool to help defenders identify vulnerable hosts in their estates.

“As we stated above, in-the-wild exploitation has already begun, according to KnownHost.” reads the advisory by watchTowr. “Therefore, we’re releasing our Detection Artifact Generator to enable defenders to identify vulnerable hosts in their estates.”

CVE-2026-41940 is an authentication bypass flaw affecting cPanel and WHM versions after 11.40. A weakness in the login flow allows remote attackers to skip or manipulate authentication checks, granting access to the control panel without valid credentials. This could let attackers manage hosting settings, access sensitive data, or take control of the server.

According to the Shadowserver Foundation, thousands of instances may be exposed.

cPanel and watchTowr released tools to detect compromise and vulnerable hosts. Exploits date back to February. Namecheap warned customers of temporary access limits to mitigate risk.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the vulnerability by May 3, 2026.

Pierluigi Paganini

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

(SecurityAffairs – hacking, US CISA Known Exploited Vulnerabilities catalog)







Source link

Leave a Reply

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.

Recent Reviews


If you’ve bought a new Raspberry Pi, or just got your hands on an older model that someone else didn’t want, there are many ways to put that little computer to good use, and here are six of them.

Retro gaming galore

Recalbox running on a Raspberry Pi 500+. Credit: Tim Brookes / How-To Geek

One of the most popular uses for Raspberry Pi computers is as a retro gaming emulation system. Which systems can be emulated depends on which specific model of Pi you have, but even the oldest ones can do a great job with retro 8-bit and 16-bit titles, or MAME arcade titles. In fact, building your own arcade cabinet with a Pi at its heart is a common project, and you’ll find lots of instructional guides on the web to that effect.

8bitdo arcade stick for Nintendo Switch.

8/10

Number of Colors

1

Control Types

Arcade Stick


Build your own NAS

A Raspberry Pi configured as a NAS. Credit: Raspberry Pi Foundation

A NAS or Network-Attached Storage device is effectively a local file server that lets you store and access data on your local network using hard drives. You can go out and buy a NAS or you can follow the official Raspberry Pi NAS tutorial and turn your old USB hard drives into a NAS using stuff you already have, or can get for just a few dollars.

Everyone loves local streaming tools like Plex or Jellyfin, but not everyone wants to dedicate an expensive computer to act as the streaming server. Well, as long as your requirements aren’t too fancy, you can use a Raspberry Pi as a Plex server.

Just don’t expect it to handle heavy-duty transcoding. The good news is that most of your client devices can probably play back videos without the need for transcoding.

Turn your Pi into a home automation hub

The Home Assistant Green smart home hub surrounded by smart home devices. Credit: home-assistant.io

Home automation hub devices can cost hundreds of dollars, but if you have an old Raspberry Pi, you can run your smart home off it. The most common and effective solution is an open-source app called Home Assistant.

Raspberry Pi logo above a photo of Raspberry Pi boards.


I Run My Smart Home Off a Raspberry Pi, Here’s How It Works

Make your home smarter on a budget with a Raspberry Pi.

Build a weather station

If you’re interested in the weather, want to contribute to weather data, or are just sick of getting rained on when you least expect it, you have the option of getting a weather station kit for your Raspberry Pi or using something like the Raspberry Pi Sense HAT, which can detect pressure, humidity, and temperature, but not wind speed. However, there are also generic wind and rain sensors you can buy, and, of course, don’t forget an outdoor project enclosure.

There are a few guides on the web, but this weather station guide for Raspberry Pi is a good place to get some ideas.

Create a home web server

Another fun project to do is hosting your own little web server using a Raspberry Pi. You can make a website that only works on your home LAN, or even host something that people from outside your home network can access. Using open source software to host your own web resources is highly educational, and it can also be a way to do something genuinely useful without having to rely on a cloud service somewhere on the internet.

Imagine having your own little bulletin board at home, or hosting content like ebooks, music, or audiobooks?


Infinite possibilities

Despite lacking in the raw power department, all Raspberry Pi devices are little miracles—single board computers that can (in principle) do anything their bigger cousins can. Just more slowly. So if you have a few old Raspberry Pis hanging around, don’t be too quick to retire them yet.



Source link