Loading story…
LiteSpeed disclosed and patched CVE-2026-54420, a high-severity privilege-escalation flaw in the LiteSpeed cPanel plugin that can let a low-privileged user gain root access on shared hosting servers. The bug affects plugin versions before 2.4.8 and stems from improper handling of user-supplied symlinks, a weakness classified as CWE-61. The issue is especially dangerous on CloudLinux/CageFS shared hosting deployments, where a single compromised tenant with FTP or web-shell access could potentially jeopardize other hosted sites on the same server.
The vulnerability has been reported as actively exploited in the wild, with exploitation observed in May 2026, and carries a CVSS 8.5 severity rating. LiteSpeed said the fix is included in cPanel plugin version 2.4.8, bundled with WHM Plugin v5.3.2.1, and urged administrators to upgrade immediately or temporarily remove the user-end plugin if patching is not yet possible. Defenders were also advised to review cPanel logs for suspicious activity, including repeated requests to certificate-related endpoints from a single IP address.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
Public reporting described CVE-2026-54420 as a privilege escalation flaw in LiteSpeed cPanel plugin versions before 2.4.8 caused by improper handling of user-provided symlinks. Reports also noted the issue was identified by Namecheap’s team and urged administrators to patch or disable the user-end plugin temporarily.
CISA added LiteSpeed cPanel plugin flaw CVE-2026-54420 to its Known Exploited Vulnerabilities catalog and, under Binding Operational Directive 22-01, ordered federal agencies to remediate it by June 18, 2026. The listing cited confirmed active exploitation and affected plugin versions prior to 2.4.8.
The LiteSpeed cPanel plugin symlink privilege escalation flaw was reportedly exploited in the wild in May 2026. The bug allows a low-privileged user with FTP or web shell access on shared hosting servers running CloudLinux/CageFS to escalate to root.
LiteSpeed published a security update for its cPanel plugin addressing the privilege escalation issue. The fix was released in cPanel plugin version 2.4.8 and bundled with WHM Plugin v5.3.2.1.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
9 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesecurityweek.com
Open sourcesecurityaffairs.com
Open sourcecybersecuritynews.com
Open sourcesecurityonline.info
Open sourcebleepingcomputer.com
Open sourcecvefeed.io
Open sourcecve.org
Open sourceblog.litespeedtech.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A privilege-escalation vulnerability tracked as **`CVE-2026-48172`** affects the LiteSpeed User-End cPanel Plugin in versions before **`2.4.5`** and was reportedly exploited in the wild. The flaw is tied to improper handling of Redis enable/disable functionality and could allow an attacker to escalate privileges, potentially reaching **root** access. The related **LiteSpeed WHM Plugin** was identified as the parent plugin but was not affected. In response, cPanel said the LiteSpeed plugin was automatically removed during a nightly update, indicating active mitigation for affected environments. Defenders were advised to review cPanel log directories for requests containing: ```text cpanel_jsonapi_func=redisAble ``` and to investigate associated IP addresses and broader system logs to determine whether exploitation attempts or successful compromise occurred.
Jun 29, 2026
cPanel warned that an undisclosed critical privilege-escalation flaw in **LiteSpeed Web Server Enterprise** before version `6.3.7` could allow a low-privilege shared-hosting account to bypass tenant-isolation controls, including CloudLinux CageFS, and obtain root access to the host. Successful exploitation could expose other customers’ websites, server configuration, and the underlying shared server. LiteSpeed released version `6.3.7`, and cPanel urged administrators to install it manually because automatic-update availability may be delayed. No CVE, severity score, technical root cause, workaround, indicators of compromise, or confirmed exploitation status has been published; the advisory applies to the Enterprise edition, while exposure of OpenLiteSpeed and `6.4.0` release candidates remains unconfirmed.
Sep 15, 2026
cPanel has patched **CVE-2026-65643**, a critical flaw in cPanel & WebHost Manager (WHM) domain-parking and addon-domain functionality. A low-privileged authenticated hosting account authorized to add parked or addon domains can create arbitrary files on the underlying server, potentially leading to code execution as `root` and full control of the host. The issue affects all supported cPanel & WHM release branches, with fixes issued for 11.110, 11.134, 11.136, and 11.138, including WP Squared. Shared and reseller-hosting operators should apply the relevant patched build immediately; systems on end-of-life branches must be upgraded to a supported release, and unpatched deployments should restrict parked- and addon-domain permissions. cPanel had not disclosed a CVSS score, detection guidance, interim mitigation, or confirmed in-the-wild exploitation.
Sep 1, 2026