actively-exploited-vulnerabilityprivilege-escalation-methodwidely-deployed-product-advisoryinternet-facing-service-vulnerability

LiteSpeed cPanel Plugin Flaw Lets Shared Hosting Users Escalate to Root

Active Exploitation · 9 sources · Updated 5mo ago · First seen Jun 14, 2026

LiteSpeed disclosed and patched CVE-2026-54420, a high-severity privilege-escalation flaw in the LiteSpeed cPanel plugin that can let a low-privileged user gain root access on shared hosting servers. The bug affects plugin versions before 2.4.8 and stems from improper handling of user-supplied symlinks, a weakness classified as CWE-61. The issue is especially dangerous on CloudLinux/CageFS shared hosting deployments, where a single compromised tenant with FTP or web-shell access could potentially jeopardize other hosted sites on the same server.

The vulnerability has been reported as actively exploited in the wild, with exploitation observed in May 2026, and carries a CVSS 8.5 severity rating. LiteSpeed said the fix is included in cPanel plugin version 2.4.8, bundled with WHM Plugin v5.3.2.1, and urged administrators to upgrade immediately or temporarily remove the user-end plugin if patching is not yet possible. Defenders were also advised to review cPanel logs for suspicious activity, including repeated requests to certificate-related endpoints from a single IP address.

This is being exploited nowSee which actors are running it and whether you're in range.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

4 events · Jun 1, 2026 – Jun 16, 2026

Jun 16, 20265mo ago
CVE-2026-54420 vulnerability details are publicly disclosed
Public reporting described CVE-2026-54420 as a privilege escalation flaw in LiteSpeed cPanel plugin versions before 2.4.8 caused by improper handling of user-provided symlinks. Reports also noted the issue was identified by Namecheap’s team and urged administrators to patch or disable the user-end plugin temporarily.
LiteSpeed cPanel Privilege Escalation Exploited in Wild
Jun 16, 20265mo ago
CISA adds CVE-2026-54420 to KEV catalog
CISA added LiteSpeed cPanel plugin flaw CVE-2026-54420 to its Known Exploited Vulnerabilities catalog and, under Binding Operational Directive 22-01, ordered federal agencies to remediate it by June 18, 2026. The listing cited confirmed active exploitation and affected plugin versions prior to 2.4.8.
U.S. CISA adds Cisco Catalyst and LiteSpeed cPanel plugin flaws to its Known Exploited Vulnerabilities catalog
Jun 14, 20265mo ago
Attackers exploit CVE-2026-54420 in the wild during May 2026
The LiteSpeed cPanel plugin symlink privilege escalation flaw was reportedly exploited in the wild in May 2026. The bug allows a low-privileged user with FTP or web shell access on shared hosting servers running CloudLinux/CageFS to escalate to root.
CVE-2026-54420 - LiteSpeed cPanel Plugin Symlink Privilege Escalation
Jun 1, 20265mo ago
LiteSpeed releases cPanel plugin security update 2.4.8
LiteSpeed published a security update for its cPanel plugin addressing the privilege escalation issue. The fix was released in cPanel plugin version 2.4.8 and bundled with WHM Plugin v5.3.2.1.
Security Update for LiteSpeed cPanel Plugin ⋆ LiteSpeed Blog

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Symlink-following privilege escalation in LiteSpeed cPanel plugin (CVE-2026-54420)

Affected products

1 linked

Cpanel

Organizations

1 linked

Litespeed Technologies

Do you run this?Correlate live exploitation activity against the software you actually run, and see where you're exposed.

See Who's Exploiting This

Source coverage

Sources

9 references tracked. Mallory keeps watching after this page renders.

Cyber Security NewsNews · Jun 19, 2026

CISA Adds LiteSpeed cPanel Plugin Vulnerability to KEV List Following Active ExploitationOpen source ↗

Security WeekNews · Jun 17, 2026

Joomla, LiteSpeed Vulnerabilities Exploited in Attacks - SecurityWeekOpen source ↗

Security AffairsNews · Jun 16, 2026

U.S. CISA adds Cisco Catalyst and LiteSpeed cPanel plugin flaws to its Known Exploited Vulnerabilities catalogOpen source ↗

Cyber Security NewsNews · Jun 16, 2026

LiteSpeed cPanel Plugin 0-Day Vulnerability Actively Exploited in the WildOpen source ↗

Security Online InfoNews · Jun 16, 2026

LiteSpeed cPanel Privilege Escalation Exploited in WildOpen source ↗

Bleeping ComputerNews · Jun 16, 2026

CISA warns of another cPanel plugin flaw exploited in attacksOpen source ↗

Cvefeed High SeverityAdvisories · Jun 14, 2026

CVE-2026-54420 - LiteSpeed cPanel Plugin Symlink Privilege EscalationOpen source ↗

CveAdvisories · Jun 1, 2026

CVE Record: CVE-2026-54420Open source ↗

UnclassifiedNews · Jun 1, 2026

Security Update for LiteSpeed cPanel Plugin ⋆ LiteSpeed BlogOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

actively-exploited-vulnerabilityprivilege-escalation-methodwidely-deployed-product-advisoryinternet-facing-service-vulnerability

LiteSpeed cPanel Plugin Flaw Lets Shared Hosting Users Escalate to Root

Active Exploitation · 9 sources · Updated 5mo ago · First seen Jun 14, 2026

This is being exploited nowSee which actors are running it and whether you're in range.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

4 events · Jun 1, 2026 – Jun 16, 2026

Jun 16, 20265mo ago
CVE-2026-54420 vulnerability details are publicly disclosed
Public reporting described CVE-2026-54420 as a privilege escalation flaw in LiteSpeed cPanel plugin versions before 2.4.8 caused by improper handling of user-provided symlinks. Reports also noted the issue was identified by Namecheap’s team and urged administrators to patch or disable the user-end plugin temporarily.
LiteSpeed cPanel Privilege Escalation Exploited in Wild
Jun 16, 20265mo ago
CISA adds CVE-2026-54420 to KEV catalog
CISA added LiteSpeed cPanel plugin flaw CVE-2026-54420 to its Known Exploited Vulnerabilities catalog and, under Binding Operational Directive 22-01, ordered federal agencies to remediate it by June 18, 2026. The listing cited confirmed active exploitation and affected plugin versions prior to 2.4.8.
U.S. CISA adds Cisco Catalyst and LiteSpeed cPanel plugin flaws to its Known Exploited Vulnerabilities catalog
Jun 14, 20265mo ago
Attackers exploit CVE-2026-54420 in the wild during May 2026
The LiteSpeed cPanel plugin symlink privilege escalation flaw was reportedly exploited in the wild in May 2026. The bug allows a low-privileged user with FTP or web shell access on shared hosting servers running CloudLinux/CageFS to escalate to root.
CVE-2026-54420 - LiteSpeed cPanel Plugin Symlink Privilege Escalation
Jun 1, 20265mo ago
LiteSpeed releases cPanel plugin security update 2.4.8
LiteSpeed published a security update for its cPanel plugin addressing the privilege escalation issue. The fix was released in cPanel plugin version 2.4.8 and bundled with WHM Plugin v5.3.2.1.
Security Update for LiteSpeed cPanel Plugin ⋆ LiteSpeed Blog

Linked entities