A hosting panel is the control room for a server: whoever reaches it can create accounts, read files and run commands as a privileged user. That makes panel flaws more serious than a bug in a single site. This page tracks the 2026 advisories for the common panels and the Cloudflare settings that sit in front of them, so you can find the one that matches your setup.
What matters right now
- cPanel and WHM CVE-2026-41940 is exploited. The login bypass was fixed on 28 April 2026 and CISA added it to its Known Exploited Vulnerabilities catalog on 30 April, marking ransomware use as known. Updating does not remove an account or session created earlier.
- Plesk has a root-level API flaw. CVE-2026-68492 in the RESTful API extension is fixed in Plesk 18.0.80.8 and 18.0.81.1 and API extension 2.4.7, per Plesk's advisory. A separate Site Import flaw is tracked as CVE-2026-87898.
- CyberPanel 2.4.4 is still affected. NVD lists CVE-2026-41472 as fixed in 2.4.5. At our 24 October 2026 check, CISA's catalog had no CyberPanel entry.
- aaPanel has several 2026 CVEs. NVD records file upload, local file inclusion and command injection issues, for example CVE-2026-113507. None was in CISA's catalog on 24 October 2026.
- Cloudflare does not cover a reachable origin. Cloudflare's own guidance on protecting your origin server says to restrict the origin to Cloudflare addresses.
Where to start
- If you run a cPanel server or ask a host to run it, start with the cPanel version check and the question to send your host.
- If your panel is Plesk, read the Plesk API and Site Import fix.
- If you run CyberPanel, use the ShadowPanel version table.
- If you installed aaPanel or BT panel, see which aaPanel CVEs NVD lists.
- If PHP2Shell is the worry, follow the per-domain PHP update steps on cPanel or the handler and worker restart check on Plesk.
- If you put Cloudflare in front of a server, test whether your origin IP is still reachable.
- If Googlebot gets 403 responses, see which Cloudflare layer blocks it. If xmlrpc.php is under attack, use the rule that keeps Jetpack working.
- If you are unsure who patches what, read who is responsible for patching your website.
The free scan reads the stack your site serves and matches each version to known vulnerabilities. It can say a version is affected. It cannot see a host backport, so your host or server confirms the rest.