{"id":699,"date":"2026-04-30T10:50:48","date_gmt":"2026-04-30T10:50:48","guid":{"rendered":"https:\/\/www.cert.hr\/novosti\/upozorenje-kriticna-ranjivost-u-cpanel-i-whm-cve-2026-41940\/"},"modified":"2026-11-04T08:40:20","modified_gmt":"2026-11-04T08:40:20","slug":"upozorenje-kriticna-ranjivost-u-cpanel-i-whm-cve-2026-41940","status":"publish","type":"post","link":"https:\/\/cert.hr\/en\/ranjivosti\/upozorenje-kriticna-ranjivost-u-cpanel-i-whm-cve-2026-41940\/","title":{"rendered":"Upozorenje: Kriti\u010dna ranjivost u cPanel i WHM (CVE-2026-41940)"},"content":{"rendered":"<p class=\"wp-block-paragraph\"><a href=\"https:\/\/cve.cert.hr\/cve\/CVE-2026-41940\">CVE-2026-41940<\/a><\/p>\n\n\n\n<p class=\"has-vivid-red-color has-text-color wp-block-paragraph\"><strong>CVSS 9.8<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Otkrivena je kriti\u010dna ranjivost u cPanel &amp; WebHost Manager (WHM) sustavima koja omogu\u0107uje potpuno zaobila\u017eenje autentifikacije. Zbog pogre\u0161ke u upravljanju sesijama, neautentificirani napada\u010d mo\u017ee preuzeti admin\/root pristup nad cijelim poslu\u017eiteljem bez poznavanja lozinke.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Napada\u010d koji dobije pristup cPanelu mo\u017ee kontrolirati sve \u0161to se nalazi na hosting ra\u010dunu, a WHM pru\u017ea pristup cijelom poslu\u017eitelju i svim web stranicama koje se na njemu nalaze.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Javno je objavljen Proof-of-Concept (PoC) k\u00f4d, a zabilje\u017eeni su i aktivni poku\u0161aji iskori\u0161tavanja ove ranjivosti.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Svim administratorima sustava savjetuje se:&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>A\u017euriranje sustava na jednu od zakrpanih verzija:<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">11.86.0.41<br>11.110.0.97<br>11.118.0.63<br>11.126.0.54<br>11.130.0.19<br>11.132.0.29<br>11.136.0.5<br>11.134.0.20<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Blokiranje pristupa javno dostupnih portova 2083 i 2087. Ograni\u010diti pristup cPanel\/WHM su\u010delju isklju\u010divo putem VPN-a ili specifi\u010dnih pouzdanih IP adresa.<\/li><li>Pregledati logove prijava na WHM i cPanel radi uo\u010davanja potencijalne sumnjive sesije ili nepoznate administratorske prijave.<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Poslu\u017eitelji koji pokre\u0107u verzije cPanela kojima je istekla podr\u0161ka ne\u0107e primiti sigurnosna a\u017euriranja. Administratorima takvih sustava strogo se preporu\u010duje hitna nadogradnja na podr\u017eanu verziju kako bi za\u0161titili svoje podatke i infrastrukturu.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Dodatne informacije mo\u017eete pro\u010ditati na:\u00a0<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"cPanel: Security: CVE-2026-41940 - cPanel &amp; WHM \/ WP2\" title=\"https:\/\/support.cpanel.net\/hc\/en-us\/articles\/40073787579671-Security-CVE-2026-41940-cPanel-WHM-WP2-Security-Update-04-28-2026\">cPanel: Security: CVE-2026-41940 - cPanel &amp; WHM \/ WP2<\/a> <\/li><li><a href=\"http:\/\/Rapid7: CVE-2026-41940: cPanel &amp; WHM Authentication Bypass\" title=\"https:\/\/www.rapid7.com\/blog\/post\/etr-cve-2026-41940-cpanel-whm-authentication-bypass\/\">Rapid7: CVE-2026-41940: cPanel &amp; WHM Authentication Bypass <\/a><\/li><li><a href=\"https:\/\/www.cyber.gc.ca\/en\/alerts-advisories\/al26-008-vulnerability-affecting-cpanel-webhost-manager-whm-cve-2026-41940\" title=\"https:\/\/www.cyber.gc.ca\/en\/alerts-advisories\/al26-008-vulnerability-affecting-cpanel-webhost-manager-whm-cve-2026-41940\">Government of Canada: AL26-008 - Vulnerability affecting cPanel and WebHost Manager<\/a><\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>","protected":false},"excerpt":{"rendered":"<p>CVE-2026-41940 CVSS 9.8 Otkrivena je kriti\u010dna ranjivost u cPanel &amp; WebHost Manager (WHM) sustavima koja omogu\u0107uje potpuno zaobila\u017eenje autentifikacije. Zbog pogre\u0161ke u upravljanju sesijama, neautentificirani napada\u010d mo\u017ee preuzeti admin\/root pristup nad cijelim poslu\u017eiteljem bez poznavanja lozinke. Napada\u010d koji dobije pristup cPanelu mo\u017ee kontrolirati sve \u0161to se nalazi na hosting ra\u010dunu, a WHM pru\u017ea pristup cijelom [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":1072,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":[],"meta":{"_acf_changed":false,"footnotes":""},"categories":[27],"tags":[],"tema":[],"class_list":["post-699","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ranjivosti"],"acf":[],"_links":{"self":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/699","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/comments?post=699"}],"version-history":[{"count":1,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/699\/revisions"}],"predecessor-version":[{"id":1075,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/699\/revisions\/1075"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/media\/1072"}],"wp:attachment":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/media?parent=699"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/categories?post=699"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/tags?post=699"},{"taxonomy":"tema","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/tema?post=699"},{"taxonomy":"format","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/format?post=699"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}