Threat Actor Mr_Rot13 Actively Exploits CVE-2026-41940 for Backdoor Deployment

Background

CVE-2026-41940 is a high-severity unauthenticated authentication bypass vulnerability affecting cPanel & WHM. This product is widely used in Linux server operations and virtual hosting management. The vulnerability has a CVSS score as high as 9.8 (Critical). Without providing any account or password, an attacker can remotely bypass authentication and take over the cPanel / WHM control panel, allowing an unauthenticated remote attacker to gain administrator privileges on the affected server.

Since the vulnerability was publicly disclosed on April 28, 2026, the XLab's Cyber Threat Insight and Analysis System(CTIA) has co…