Privilege Escalation (Possible Root) in LiteSpeed cPanel Plugin
CISA: LiteSpeed cPanel Plugin Privilege Escalation Vulnerability
CVE-2026-48172 is a critical privilege-escalation flaw (CWE-266, incorrect privilege assignment) in the LiteSpeed User-End cPanel plugin before 2.4.5, stemming from mishandling of the plugin's Redis enable/disable feature. It is exploitable over the network without authentication or user interaction (CVSS 4.0: AV:N/AC:L/PR:N/UI:N), and exploitation leaves traces of requests to the cPanel API's redisAble function in cPanel logs. An attacker who exploits it can elevate privileges to possibly root on the hosting server, meaning a single attacker could take control of every account and site hosted on that server. At risk are hosting providers and organizations running cPanel/WHM with the LiteSpeed cPanel plugin (and the related WHM plugin), a common premium web-server setup on multi-tenant shared-hosting platforms. The flaw was exploited in the wild in May 2026, was added to CISA's KEV catalog on 2026-05-26, and carries an EPSS of 18.9% (97th percentile); no public PoC is known.
What to do: Upgrade the LiteSpeed User-End cPanel plugin to at least version 2.4.7 (versions before 2.4.5 are affected; 2.4.7 is the recommended minimum). Hunt for exploitation by running grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash: no output means you were not hit, while hits should be validated (confirm the listed IPs are legitimate, block any that are not, and review system logs for actions taken by those IPs). Because this is a CISA KEV entry (added 2026-05-26), apply the vendor fix per BOD 22-01 timelines or discontinue use of the product if mitigations are unavailable.
| Product | Affected |
|---|---|
| LiteSpeed Technologies (litespeedtech) LiteSpeed User-End cPanel Plugin | before 2.4.5 (upgrade recommended to at least 2.4.7) |
| LiteSpeed Technologies (litespeedtech) LiteSpeed WHM Plugin | listed in CPE data; no version range specified in source |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash. If you get no output, you have not been hit with exploitation of the vulnerability. If there is output, we recommend you examine the IP addresses in the list, determine if they are valid IP addresses, and if not, block them. To determine damage done, examine the system logs for use by the detected IP addresses. The issue is related to mishandling of Redis enable/disable features. The recommended minimum version is 2.4.7.
cPanel patched critical flaw CVE-2026-65643 letting authenticated hosting customers with addon or parked domain rights execute code as root and fully compromise servers.
cPanel warns critical LiteSpeed Web Server Enterprise flaw (pre-6.3.7) lets shared-hosting account users gain root access.
Critical LiteSpeed Web Server Enterprise flaw (pre-6.3.7) lets a low-privilege shared-hosting tenant escape CageFS isolation and gain root; forced update urged.
Today 1K readers · 1.5K views · 1.1K reads · all time 159K views