U.S. CISA adds LiteSpeed cPanel Plugin flaw to its Known Exploited Vulnerabilities catalog
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-48172 | Privilege Escalation (Possible Root) in LiteSpeed cPanel Plugin CVE-2026-48172 is a critical privilege-escalation flaw (CWE-266, incorrect privilege assignment) in the LiteSpeed User-End cPanel plugin before 2.4.5, stemming from mishandling of the plugin's Redis enable/disable feature. It is exploitable over the network without authentication or user interaction (CVSS 4.0: AV:N/AC:L/PR:N/UI:N), and exploitation leaves traces of requests to the cPanel API's redisAble function in cPanel logs. An attacker who exploits it can elevate privileges to possibly root on the hosting server, meaning a single attacker could take control of every account and site hosted on that server. At risk are hosting providers and organizations running cPanel/WHM with the LiteSpeed cPanel plugin (and the related WHM plugin), a common premium web-server setup on multi-tenant shared-hosting platforms. The flaw was exploited in the wild in May 2026, was added to CISA's KEV catalog on 2026-05-26, and carries an EPSS of 18.9% (97th percentile); no public PoC is known. Do: Upgrade the LiteSpeed User-End cPanel plugin to at least version 2.4.7 (versions before 2.4.5 are affected; 2.4.7 is the recommended minimum). Hunt for exploitation by running grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash: no output means you were not hit, while hits should be validated (confirm the listed IPs are legitimate, block any that are not, and review system logs for actions taken by those IPs). Because this is a CISA KEV entry (added 2026-05-26), apply the vendor fix per BOD 22-01 timelines or discontinue use of the product if mitigations are unavailable. | 10.0 | 19% | KEV |
| largelikely tens of thousands of multi-tenant cPanel hosting servers (order of 10k-50k), with 100k+ tenant accounts behind them |
Full article345 words · extracted from securityaffairs.com · click to collapse
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds LiteSpeed cPanel Plugin flaw to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the LiteSpeed cPanel Plugin flaw CVE-2026-48172 to its Known Exploited Vulnerabilities (KEV) catalog.
CVE-2026-48172 (CVSS score of 10.0) affects the LiteSpeed User-End cPanel plugin before version 2.4.5 and allows privilege escalation, potentially up to root, and has been exploited in the wild. The flaw comes from improper handling of Redis enable/disable functions. Attackers can abuse it to run unauthorized actions on affected servers. Detection involves searching cPanel logs for suspicious Redis-related API calls, while mitigation requires upgrading to at least version 2.4.7 and reviewing logs and IP activity for signs of compromise.
LiteSpeed released emergency patches for CVE-2026-48172, warning that the flaw is actively exploited in cPanel user-end plugin versions v2.3 through v2.4.4. Admins should update immediately and check logs with a provided grep command to detect suspicious IP activity and investigate possible compromise.
“Any cPanel user (including an attacker or a compromised account) may exploit the lsws.redisAble function to execute arbitrary scripts as root.” reads the advisory. “This vulnerability is being actively exploited, and poses a risk for all user-end plugin versions between v2.3 and v2.4.4.”
Run this command to check if your server is affected:
grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null
If it returns no output, your server is not affected. If it returns results, review the listed IPs, verify if they are legitimate, block suspicious ones, and check system logs to assess any potential impact or unauthorized actions.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix the vulnerabilities by May 29, 2026.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/192795/hacking/u-s-cisa-adds-litespeed-cpanel-plugin-flaw-to-its-known-exploited-vulnerabilities-catalog.html