Critical cPanel Vulnerability Exploited for Hosting Server Compromise

• •CVE-2026-41940 allows unauthenticated access to cPanel and WHM.
• •Exploitation activity surged immediately after public disclosure on April 30, 2026.
• •Compromised servers can lead to significant data exposure and malware deployment.

Threat actors exploited CVE-2026-41940, a critical authentication bypass in cPanel and WHM, allowing remote, unauthenticated access to hosting servers. The vulnerability, with a CVSS score of 9.8, affects cPanel versions released after 11.40. Following the public disclosure on April 29, 2026, exploitation activity surged starting April 30, particularly targeting Telnet services. JPCERT/CC reported a significant increase in Mirai-like scanning traffic, with many malicious hosts identified as running cPanel. The exploitation led to deployment of Mirai-family malware and ransomware attacks. cPanel issued patches on April 28, 2026, but many systems remained vulnerable post-disclosure. The campaign represents a shift in Mirai's operational scope, now targeting hosting servers for greater bandwidth and processing power.