LiteSpeed Enterprise Flaw Could Let One Hosting Account Gain Root Access on a Shared Server
cPanel warns critical LiteSpeed Web Server Enterprise flaw (pre-6.3.7) lets shared-hosting account users gain root access.
A cPanel advisory published September 14 warns that a critical vulnerability in LiteSpeed Web Server Enterprise versions before 6.3.7 lets a low-privilege website user gain root access on shared-hosting servers, bypassing CageFS account isolation. LiteSpeed released version 6.3.7 on September 11, but auto-update may be delayed so admins should force the update manually. No CVE identifier, severity score, workaround, or exploitation information has been published. This is the third LiteSpeed root flaw since May, following CVE-2026-48172 and CVE-2026-54420 in the cPanel plugin, which were both actively exploited and added to CISA's KEV catalog.
- Flaw in LiteSpeed Web Server Enterprise before 6.3.7 grants root from hosting account.
- Bypasses CageFS isolation on shared cPanel servers; affects other tenants.
- No CVE, severity score, or workaround published; exploitation status unknown.
- Manual update recommended: auto-update to 6.3.7 may be delayed.
- Third LiteSpeed root flaw since May; prior two actively exploited and KEV-listed.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-48172 | Privilege Escalation (Possible Root) in LiteSpeed cPanel Plugin | 10.0 | 18% | KEV | KEV |
| CVE-2026-54420 | Symlink-Following Privilege Escalation in LiteSpeed cPanel Plugin Exploited in the Wild | 8.5 | 1% | KEV | KEV |
From the original article
2 min read at thehackernews.com
A critical vulnerability in LiteSpeed Web Server Enterprise could let a low-privilege website user gain root access on a shared-hosting server, cPanel warned in an advisory published on September 14. On such servers, many customers' sites run on a single machine, and an attacker with one of those hosting accounts could exploit the flaw to access or alter other sites and the server itself,
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.