LiteSpeed Enterprise Flaw Could Let One Hosting Account Gain Root Access on a Shared Server
cPanel warns critical LiteSpeed Web Server Enterprise flaw (pre-6.3.7) lets shared-hosting account users gain root access.
A cPanel advisory published September 14 warns that a critical vulnerability in LiteSpeed Web Server Enterprise versions before 6.3.7 lets a low-privilege website user gain root access on shared-hosting servers, bypassing CageFS account isolation. LiteSpeed released version 6.3.7 on September 11, but auto-update may be delayed so admins should force the update manually. No CVE identifier, severity score, workaround, or exploitation information has been published. This is the third LiteSpeed root flaw since May, following CVE-2026-48172 and CVE-2026-54420 in the cPanel plugin, which were both actively exploited and added to CISA's KEV catalog.
- Flaw in LiteSpeed Web Server Enterprise before 6.3.7 grants root from hosting account.
- Bypasses CageFS isolation on shared cPanel servers; affects other tenants.
- No CVE, severity score, or workaround published; exploitation status unknown.
- Manual update recommended: auto-update to 6.3.7 may be delayed.
- Third LiteSpeed root flaw since May; prior two actively exploited and KEV-listed.
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-48172 | Privilege Escalation (Possible Root) in LiteSpeed cPanel Plugin CVE-2026-48172 is a critical privilege-escalation flaw (CWE-266, incorrect privilege assignment) in the LiteSpeed User-End cPanel plugin before 2.4.5, stemming from mishandling of the plugin's Redis enable/disable feature. It is exploitable over the network without authentication or user interaction (CVSS 4.0: AV:N/AC:L/PR:N/UI:N), and exploitation leaves traces of requests to the cPanel API's redisAble function in cPanel logs. An attacker who exploits it can elevate privileges to possibly root on the hosting server, meaning a single attacker could take control of every account and site hosted on that server. At risk are hosting providers and organizations running cPanel/WHM with the LiteSpeed cPanel plugin (and the related WHM plugin), a common premium web-server setup on multi-tenant shared-hosting platforms. The flaw was exploited in the wild in May 2026, was added to CISA's KEV catalog on 2026-05-26, and carries an EPSS of 18.9% (97th percentile); no public PoC is known. Do: Upgrade the LiteSpeed User-End cPanel plugin to at least version 2.4.7 (versions before 2.4.5 are affected; 2.4.7 is the recommended minimum). Hunt for exploitation by running grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash: no output means you were not hit, while hits should be validated (confirm the listed IPs are legitimate, block any that are not, and review system logs for actions taken by those IPs). Because this is a CISA KEV entry (added 2026-05-26), apply the vendor fix per BOD 22-01 timelines or discontinue use of the product if mitigations are unavailable. | 10.0 | 19% | KEV |
| largelikely tens of thousands of multi-tenant cPanel hosting servers (order of 10k-50k), with 100k+ tenant accounts behind them | |
| CVE-2026-54420 | Symlink-Following Privilege Escalation in LiteSpeed cPanel Plugin Exploited in the Wild The LiteSpeed cPanel plugin, as distributed through the LiteSpeed WHM plugin, before version 2.4.8 (WHM plugin 5.3.2.0) mishandles UNIX symbolic links supplied by users (CWE-61). An attacker who already has FTP or web shell access to any account on a shared hosting server running CloudLinux/CageFS can plant a crafted symlink that the privileged plugin follows, letting them act beyond their own account scope — reportedly gaining root control of the entire server (CVSS scope change, C:H/I:H/A:H). Any hosting provider running vulnerable versions of the LiteSpeed cPanel/WHM plugin is affected, and because this is shared hosting, a single malicious tenant endangers other customers on the same server. The flaw was exploited in the wild in May 2026, was added to CISA's Known Exploited Vulnerabilities catalog on 2026-06-15 (BOD 26-04 remediation obligations apply), and has a 1.4% 30-day EPSS; no public proof-of-concept is known. Do: Upgrade the LiteSpeed cPanel plugin to 2.4.8 or later via the LiteSpeed WHM plugin 5.3.2.0 or later, following vendor instructions to meet CISA KEV/BOD 26-04 timelines. Until patched, restrict or monitor FTP and web shell access on affected shared hosting servers and review logs for signs of privilege escalation during and since May 2026; if mitigations are unavailable, follow applicable BOD 26-04 guidance for cloud services or discontinue use. | 8.5 | 1% | KEV |
| largeest. tens of thousands of shared hosting servers (~10^4–10^5), each hosting many customer accounts |
Full article529 words · extracted from thehackernews.com · click to collapse
Swati KhandelwalSep 15, 2026Vulnerability / Web Security
A critical vulnerability in LiteSpeed Web Server Enterprise could let a low-privilege website user gain root access on a shared-hosting server, cPanel warned in an advisory published on September 14.
On such servers, many customers' sites run on a single machine, and an attacker with one of those hosting accounts could exploit the flaw to access or alter other sites and the server itself, according to the advisory.
cPanel said it had received notice of the flaw, which affects versions before 6.3.7, and urged administrators to update to that release, which LiteSpeed published on September 11.
The flaw can bypass the controls that keep hosting accounts apart, including CageFS, cPanel said. CageFS is a CloudLinux tool that gives each hosting account a restricted view of the file system, so it cannot see other accounts or the server's configuration files.
Neither cPanel's advisory nor LiteSpeed's release notes describe how the flaw works. LiteSpeed's announcement of 6.3.7 called it a release with "Security improvements, bug fixes, and more!" Its changelog lists three security changes but does not mention a privilege-escalation flaw, and neither company has said publicly which change fixes it.
The advisory carries no CVE identifier or severity score, and a check of published CVE records on September 15 found none for the flaw. The advisory also does not say whether the flaw has been exploited.
Both cPanel and LiteSpeed give the same command to install 6.3.7 now: /usr/local/lsws/admin/misc/lsup.sh -f -v 6.3.7
The manual update matters because 6.3.7 may not arrive on its own: LiteSpeed said there "may be some delay" before the release reaches auto-update.
As of September 15, LiteSpeed's download page still listed 6.3.6 as the stable release, alongside a July pre-release build of 6.4.0 (RC1) whose changelog does not list the three security changes. cPanel's advisory does not say whether the 6.4.0 release candidates are affected.
LiteSpeed's update documentation says that forcing a specific version with this command stops the server from following its stable update tier, and that administrators can resume automatic stable updates afterward by running touch /usr/local/lsws/autoupdate/follow_stable.
Neither cPanel's advisory nor LiteSpeed's release notes offer a workaround for servers that cannot update at once, or indicators for checking whether a server has already been attacked. The advisory names only the Enterprise edition and does not address OpenLiteSpeed, LiteSpeed's open-source server, for which LiteSpeed had released no matching update as of September 15.
It is the third time since May that a flaw in LiteSpeed software on cPanel servers has been reported to grant a hosting account root access, but the first in the web server itself.
In May and June, LiteSpeed disclosed two such flaws in its user-end cPanel plugin, CVE-2026-48172 and CVE-2026-54420, said both were being actively exploited, and fixed both in the plugin. CISA later added both to its Known Exploited Vulnerabilities catalog, as The Hacker News reported in May and June.
The Hacker News has contacted LiteSpeed, cPanel, and CloudLinux with questions about the flaw.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/09/litespeed-enterprise-flaw-could-let-one.html