Hackers Exploit cPanel CVE-2026-41940 Auth Bypass to Deploy Mirai Malware
Attackers are exploiting CVE-2026-41940, a critical unauthenticated cPanel/WHM auth bypass, to compromise hosting servers and recruit them into Mirai botnets.
JPCERT/CC observed a sharp rise in Mirai-like packets targeting TCP port 23 beginning April 30, with many source addresses at hosting providers exposing cPanel/WHM admin interfaces. CVE-2026-41940 lets unauthenticated attackers bypass login on vulnerable cPanel and WHM systems to gain administrative access, alter settings, add malicious files, and pivot to other systems. Exploitation was likely tied to Mirai or a Mirai variant, converting hosting servers into botnet nodes; Japanese-origin Telnet traffic rose to roughly 15 times prior levels. The US accounted for the largest traffic share, with sharp increases around May 1 in Germany, France, and Canada.
- JPCERT/CC saw Mirai-like traffic to TCP port 23 surge starting April 30
- Many source addresses belonged to hosting providers exposing cPanel/WHM admin interfaces
- CVE-2026-41940 allows unauthenticated attackers to bypass login and gain administrative access
- Japanese-source Telnet traffic rose to roughly 15 times pre-surge levels; US had the largest share
- Defenders should patch cPanel, disable Telnet, enforce strong credentials, and review admin logs
- CVEs
- CVE-2026-41940
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-41940 | Missing-Authentication Bypass in WebPros cPanel & WHM (AuthBypass to RCE) | 9.3 | 99% | KEVRansomwarePoC ×9 | KEV |
From the original article
3 min read at cybersecuritynews.com
Hackers are exploiting a critical cPanel and WHM flaw to place Mirai malware on exposed servers, extending a botnet threat normally associated with connected devices. The activity produced a sharp rise in suspicious Telnet traffic and exposed a wider Internet security problem. Its use directly against servers creates concern for organizations that may not associate […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.