Blog · 2-hour update · 2026-10-26

CVE-2026-41940 Cpanel: exploited in ransomware attacks, patch now

By the PatchTheCVE security team · Updated 2026-10-27 · Data from NVD, CISA KEV, EPSS and vendor advisories

On 26 October 2026, 375 new CVEs were published that we track: 4 critical, 8 already exploited in the wild (CISA KEV) and 0 with a fix or vendor patch available. Each one is ranked by severity, exploitation signals and how easy it is to reach, so you can patch the right ones first.

Key takeaways

• Most urgent: CVE-2026-41940 (Cpanel): upgrade to 86.0.41, 110.0.97, 118.0.63, 124.0.35, 126.0.54, 130.0.19, 132.0.29, 134.0.20, 136.0.5.
• 8 exploited in the wild (CISA KEV): patch these before anything else.
• 3 of the top 8 can be attacked over the network without a login.
• 0 of 375 new CVEs already have a fix or vendor patch.
• Most affected vendors: totolink, itsourcecode.

What happened in this 2-hour window: the most serious item is CVE-2026-41940 in cpanel (critical, CVSS 9.8, priority 100/100). Recommended action: upgrade to 86.0.41, 110.0.97, 118.0.63, 124.0.35, 126.0.54, 130.0.19, 132.0.29, 134.0.20, 136.0.5. 8 new CVEs from the list below are already being exploited (CVE-2026-41940, CVE-2026-42208, CVE-2026-39808, and more), so those go first. 3 of the 8 top items can be attacked remotely without a login. At least one is linked to ransomware campaigns. Most affected: totolink (2), itsourcecode (1). 0 of 375 new CVEs already have a fix or vendor patch; for the other 375, follow the downgrade or mitigation steps until one ships.

Patch these first

CVE-2026-41940: WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

• Risk: Critical (CVSS 9.8), priority 100/100 (patch now), published 29 April 2026
• Exploitation: exploited in the wild (CISA KEV), federal due date 2026-05-03; used in ransomware campaigns; 98.5% chance of exploitation in the next 30 days (EPSS); attackable over the network without a login
• Affected: cpanel cpanel (>= 11.40 and < 86.0.41, >= 88.0.0 and < 110.0.97, >= 112.0.0 and < 118.0.63)
• Fixed in: 86.0.41, 110.0.97, 118.0.63, 124.0.35, 126.0.54, 130.0.19, 132.0.29, 134.0.20, 136.0.5
• What to do: upgrade to 86.0.41, 110.0.97, 118.0.63, 124.0.35, 126.0.54, 130.0.19, 132.0.29, 134.0.20, 136.0.5 for cpanel cpanel

Why it ranks here: critical severity; epss top 1%: very likely to be exploited; exploited in the wild (cisa kev).

References: NVD · Vendor Advisory

CVE-2026-42208: BerriAI LiteLLM SQL Injection Vulnerability

• Risk: Critical (CVSS 9.8), priority 97/100 (patch now), published 8 May 2026
• Exploitation: exploited in the wild (CISA KEV), federal due date 2026-05-11; 89.4% chance of exploitation in the next 30 days (EPSS); attackable over the network without a login
• Affected: litellm litellm (>= 1.81.16 and < 1.83.7)
• Fixed in: 1.83.7
• What to do: upgrade to 1.83.7 for litellm litellm

Why it ranks here: critical severity; epss top 1%: very likely to be exploited; exploited in the wild (cisa kev).

References: NVD · Mitigation, Patch · Mitigation, Third Party Advisory

CVE-2026-39808: Fortinet FortiSandbox OS Command Injection Vulnerability

• Risk: Critical (CVSS 9.8), priority 94/100 (patch now), published 14 April 2026
• Exploitation: exploited in the wild (CISA KEV), federal due date 2026-07-19; 93.2% chance of exploitation in the next 30 days (EPSS); attackable over the network without a login
• Affected: fortinet fortisandbox (>= 4.4.0 and <= 4.4.9)
• Fixed in: newer than 4.4.9
• What to do: upgrade to newer than 4.4.9 for fortinet fortisandbox

Why it ranks here: critical severity; epss top 1%: very likely to be exploited; exploited in the wild (cisa kev).

References: NVD · Vendor Advisory

CVE-2026-42271: BerriAI LiteLLM Command Injection Vulnerability

• Risk: High (CVSS 8.8), priority 91/100 (patch now), published 8 May 2026
• Exploitation: exploited in the wild (CISA KEV), federal due date 2026-06-22; 91.4% chance of exploitation in the next 30 days (EPSS)
• Affected: litellm litellm (>= 1.74.2 and < 1.83.7)
• Fixed in: 1.83.7
• What to do: upgrade to 1.83.7 for litellm litellm

Why it ranks here: high severity; epss top 1%: very likely to be exploited; exploited in the wild (cisa kev).

References: NVD · Mitigation, Patch

CVE-2026-86950: Apple Multiple Products Out-of-Bounds Write Vulnerability

• Risk: High (CVSS 8.8), priority 80/100 (patch now), published 28 September 2026
• Exploitation: exploited in the wild (CISA KEV), federal due date 2026-10-13; 26.2% chance of exploitation in the next 30 days (EPSS)
• Affected: apple ipados (< 26.7.1)
• Fixed in: 26.7.1
• What to do: upgrade to 26.7.1 for apple ipados

Why it ranks here: high severity; epss top 2%: very likely to be exploited; exploited in the wild (cisa kev).

References: NVD · Release Notes, Vendor Advisory · Release Notes, Vendor Advisory

CVE-2026-34621: Adobe Acrobat and Reader Prototype Pollution Vulnerability

• Risk: High (CVSS 8.6), priority 79/100 (patch now), published 11 April 2026
• Exploitation: exploited in the wild (CISA KEV), federal due date 2026-04-27; 7.2% chance of exploitation in the next 30 days (EPSS)
• Affected: adobe acrobat dc (< 26.001.21411)
• Fixed in: 26.001.21411
• What to do: upgrade to 26.001.21411 for adobe acrobat dc

Why it ranks here: high severity; epss top 6%: very likely to be exploited; exploited in the wild (cisa kev).

References: NVD · Vendor Advisory

CVE-2026-32202: Microsoft Windows Protection Mechanism Failure Vulnerability

• Risk: Medium (CVSS 4.3), priority 75/100 (patch now), published 14 April 2026
• Exploitation: exploited in the wild (CISA KEV), federal due date 2026-05-12; 70.9% chance of exploitation in the next 30 days (EPSS)
• Affected: microsoft windows 10 1607 (< 10.0.14393.9060)
• Fixed in: 10.0.14393.9060
• What to do: upgrade to 10.0.14393.9060 for microsoft windows 10 1607

Why it ranks here: epss top 1%: very likely to be exploited; exploited in the wild (cisa kev); public exploit reference.

References: NVD · Vendor Advisory · Mitigation, Third Party Advisory

CVE-2026-6973: Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability

• Risk: High (CVSS 7.2), priority 75/100 (patch now), published 7 May 2026
• Exploitation: exploited in the wild (CISA KEV), federal due date 2026-05-10; 34.5% chance of exploitation in the next 30 days (EPSS)
• Affected: ivanti endpoint manager mobile (< 12.6.1.1, 12.7.0.0, 12.8.0.0)
• Fixed in: 12.6.1.1
• What to do: upgrade to 12.6.1.1 for ivanti endpoint manager mobile

Why it ranks here: high severity; epss top 2%: very likely to be exploited; exploited in the wild (cisa kev).

References: NVD · Vendor Advisory

Most affected vendors

• totolink: 2 new CVEs
• itsourcecode: 1 new CVE

How to act on this list

1. Start with anything marked exploited or patch now.
2. Check what you run: see how to check a version and patch it on Linux, Windows, pip and npm.
3. Prefer the vendor or distro fix. If none exists, read when to downgrade and when to mitigate.
4. Verify afterwards. Distros often fix a flaw without changing the upstream version, here is how to confirm.

FAQ

What is the most serious vulnerability published on 26 October 2026?

CVE-2026-41940 (WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability) ranks highest, with a priority score of 100/100. Recommended action: upgrade to 86.0.41, 110.0.97, 118.0.63, 124.0.35, 126.0.54, 130.0.19, 132.0.29, 134.0.20, 136.0.5.

Are any of the new CVEs exploited in the wild?

Yes, 8 of the new CVEs appear on the CISA Known Exploited Vulnerabilities list. Patch those first.

Should I downgrade if there is no fix yet?

Only when an older release is confirmed unaffected and the package is not a core system component. Downgrades can break dependent software, so test first and hold the package until a fix ships.

Sources

• NIST National Vulnerability Database: CVE details and affected versions
• CVE Program: official CVE records
• CISA Known Exploited Vulnerabilities catalog: exploitation in the wild
• FIRST EPSS: exploit probability
• Distribution and vendor advisories linked under each item.

Keep reading

• Patch now: the highest-priority CVEs
• CVEs exploited in the wild (CISA KEV)
• Exploited this week
• Windows KB updates by version
• Software A to Z
• Patching guides for Linux, Windows, pip and npm
• Check my software against these CVEs

← All posts