CISA Flags LiteSpeed cPanel Plugin Flaw Exploited for Root Privilege Escalation
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-54420 | Symlink-Following Privilege Escalation in LiteSpeed cPanel Plugin Exploited in the Wild The LiteSpeed cPanel plugin, as distributed through the LiteSpeed WHM plugin, before version 2.4.8 (WHM plugin 5.3.2.0) mishandles UNIX symbolic links supplied by users (CWE-61). An attacker who already has FTP or web shell access to any account on a shared hosting server running CloudLinux/CageFS can plant a crafted symlink that the privileged plugin follows, letting them act beyond their own account scope — reportedly gaining root control of the entire server (CVSS scope change, C:H/I:H/A:H). Any hosting provider running vulnerable versions of the LiteSpeed cPanel/WHM plugin is affected, and because this is shared hosting, a single malicious tenant endangers other customers on the same server. The flaw was exploited in the wild in May 2026, was added to CISA's Known Exploited Vulnerabilities catalog on 2026-06-15 (BOD 26-04 remediation obligations apply), and has a 1.4% 30-day EPSS; no public proof-of-concept is known. Do: Upgrade the LiteSpeed cPanel plugin to 2.4.8 or later via the LiteSpeed WHM plugin 5.3.2.0 or later, following vendor instructions to meet CISA KEV/BOD 26-04 timelines. Until patched, restrict or monitor FTP and web shell access on affected shared hosting servers and review logs for signs of privilege escalation during and since May 2026; if mitigations are unavailable, follow applicable BOD 26-04 guidance for cloud services or discontinue use. | 8.5 | 1% | KEV |
| largeest. tens of thousands of shared hosting servers (~10^4–10^5), each hosting many customer accounts |
Full article302 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJun 16, 2026Vulnerability / Server Security
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a security flaw impacting LiteSpeed cPanel Plugin to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by June 18, 2026.
The vulnerability in question is CVE-2026-54420 (CVSS score: 8.5), which has been described as a case of privilege escalation. It allows a user with FTP or web shell access to escalate privileges to root on shared hosting servers running CloudLinux or CageFS.
"LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS," according to a description of the vulnerability in CVE.org.
It's currently not known how the vulnerability is being exploited in the wild and if any of those attacks have been successful, but LiteSpeed has urged users to run the command below to check if their servers are affected -
grep -rE 'cpanel_jsonapi_func=(generateEcCert|packageUserSize)|cert_action_entry .*geneccert' /usr/local/cpanel/logs/ /var/cpanel/logs/ 2>/dev/nullIf the grep command does not show any output, it indicates the server has not been impacted by the issue. If there is any output, LiteSpeed has shared additional indicators to rule out any false positives -
- generateEcCert immediately followed by packageUserSize for the same user (legitimate UI flows don't chain these)
- 7-10 concurrent calls per attempt (legitimate UI does one at a time)
Namecheap has been credited with bringing the issue to its attention on May 31, 2026. Users are advised to upgrade to LiteSpeed WHM Plugin v5.3.2.1 (bundled w/ cPanel plugin v2.4.8) or higher to patch the vulnerability.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/06/cisa-flags-litespeed-cpanel-plugin-flaw.html