cPanel CVE-2026-41940 Exploited to Deploy Mirai Botnet Malware
Hackers are leveraging a critical authentication bypass vulnerability in cPanel and WHM (CVE-2026-41940) to deploy the Mirai botnet malware, turning compromised hosting servers into botnet nodes.
A critical authentication bypass vulnerability in cPanel and WHM, identified as CVE-2026-41940, is being actively exploited by threat actors to deploy the Mirai malware. This flaw allows unauthenticated attackers to gain administrative access to vulnerable servers, enabling them to alter system settings, install malicious files, and ultimately transform hosting infrastructure into footholds for botnet operations.
The exploitation of CVE-2026-41940 has led to a noticeable surge in suspicious Telnet traffic, primarily originating from compromised hosting providers. This activity highlights a significant security concern: the potential for traditional web hosting environments to be co-opted into botnet ecosystems, a threat typically associated with Internet of Things (IoT) devices.
Researchers at JPCERT/CC observed a sharp increase in Mirai-like packets targeting TCP port 23, commonly used by the Telnet protocol, beginning on April 30th. While the monitoring alone could not definitively confirm the infection vector, subsequent analysis and reporting strongly suggest a connection to Mirai or its variants exploiting this specific cPanel vulnerability. The compromised servers, often belonging to hosting providers, were found to have exposed cPanel administration interfaces.
Once an attacker gains administrative access through the authentication bypass, they can perform a range of malicious actions. This includes establishing a persistent presence on the server, probing for additional vulnerable services, spreading to other systems, or contributing to denial-of-service attacks. The impact is amplified when providers manage numerous websites on a single compromised server, potentially affecting multiple clients.
The observed malicious traffic was geographically distributed, with significant increases noted in the United States, Germany, France, Canada, and Japan. This widespread pattern indicates that the exploitation is not confined to a single region or provider, underscoring the global reach of the threat. Many of the source IP addresses involved were traced back to hosting providers, further linking the activity to compromised server infrastructure.
To mitigate this threat, administrators are urged to promptly apply vendor patches for CVE-2026-41940 to all affected cPanel and WHM installations. Additionally, security best practices such as restricting remote administration access to trusted networks, disabling Telnet where unnecessary, and enforcing strong, unique passwords are crucial. Organizations should also conduct thorough security audits, monitoring for unusual processes, network connections, and administrative activities.
The exploitation of cPanel and WHM for botnet deployment serves as a stark reminder that management interfaces are high-value targets. Regular patching, robust monitoring, and a defense-in-depth strategy are essential to protect hosting environments from becoming nodes in large-scale botnet operations. The Mirai botnet, known for its adaptability, continues to evolve, demonstrating that no system is immune to compromise.
This incident underscores the ongoing threat posed by unpatched vulnerabilities in critical infrastructure management software. The ability for attackers to leverage such flaws to repurpose legitimate servers for malicious activities like botnet expansion necessitates continuous vigilance and proactive security measures from hosting providers and their customers alike.