A critical-severity authentication bypass vulnerability in cPanel & WHM has been exploited as a zero-day since February 2026.