Critical Zero-Day in LiteSpeed cPanel Plugin Exploited in the Wild A severe zero-day vulnerability (CVE-2026-54420) in the LiteSpeed cPanel user-end plugin is being actively exploited, enabling attackers to escalate privileges to root and fully compromise affected servers. The flaw, discovered by Namecheap researchers after observing suspicious activity, specifically targets shared hosting environments by breaking tenant isolation mechanisms like CloudLinux’s CageFS. The vulnerability stems from improper API handling in the plugin, allowing attackers with limited access such as FTP credentials or a web shell to chain internal functions (generateEcCert and packageUserSize) in rapid, automated sequences. These exploitation attempts generate detectable anomalies, including bursts of 7–10 concurrent requests from a single IP, deviating from normal user behavior. LiteSpeed released a patch on June 1, 2026, in cPanel plugin version 2.4.8 (bundled with WHM plugin 5.3.2.1), addressing the issue by tightening access controls. The vulnerability was responsibly disclosed on May 31, 2026, with the CVE assigned on June 14, 2026. While the flaw affects only the user-end plugin, its inclusion in WHM plugin installations leaves many environments exposed if unpatched. Security experts warn of severe risks in multi-tenant setups, where a single compromised account could lead to full server takeover. Temporary mitigation involves removing the user-end plugin, but immediate patching is strongly recommended. Administrators are also advised to audit logs for signs of exploitation, such as unauthorized privilege changes or suspicious file modifications.

CISA Warns of Actively Exploited LiteSpeed cPanel Plugin Vulnerability (CVE-2026-48172) The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert regarding CVE-2026-48172, a critical privilege escalation vulnerability in the LiteSpeed cPanel Plugin that is being actively exploited in the wild. The flaw, classified under CWE-266 (Improper Privilege Management), allows attackers with basic cPanel access to execute arbitrary scripts with root-level privileges, enabling full administrative control over affected servers. The vulnerability poses a severe risk to shared hosting environments and cloud-based infrastructures, where multiple users operate on the same system. Even a low-privileged or compromised account can serve as an entry point for attackers to execute commands, alter configurations, implant backdoors, or access sensitive data belonging to other users on the server. While no direct links to ransomware campaigns have been confirmed, the flaw’s potential for lateral movement makes it a prime target for threat actors. CVE-2026-48172 was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on May 26, 2026, with federal agencies and organizations required to remediate the issue by May 29, 2026. CISA has urged immediate patching or mitigation, including restricting user permissions and monitoring for suspicious activity such as unauthorized script execution or privilege escalation. In cases where patches are unavailable, discontinuing use of the plugin may be necessary to mitigate exposure. Given LiteSpeed’s widespread adoption in web hosting, the vulnerability threatens service providers and enterprises, with potential consequences including server compromise, service disruption, or unauthorized data access. Security teams are advised to prioritize remediation, enforce strict access controls, and enhance monitoring to prevent exploitation.