ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Story · 2 sources · 2 articlesfirst updated ()

Critical LiteSpeed Web Server Enterprise Flaw (Pre-6.3.7) Could Let One Shared-Hosting Tenant Gain Root

highVulnerabilityimportance 58CVE-2026-48172CVE-2026-54420
What's new: First merged summary for this story. Both reports (The Hacker News, Security Affairs, September 15, 2026) agree on all facts; no conflicts found. Security Affairs adds the specific forced-update command, the auto-update channel status as of September 15, and the note that OpenLiteSpeed has no matching update.
Merged summary · glm-5.3 · rewritten as coverage arrives

cPanel warns a critical LiteSpeed Web Server Enterprise vulnerability fixed in 6.3.7 lets a low-privilege shared-hosting account escape CageFS isolation and gain root; admins should force the update manually since 6.3.7 is not yet on the stable auto-update…

A cPanel advisory published September 14 warns of a critical privilege-escalation vulnerability in LiteSpeed Web Server Enterprise versions before 6.3.7 that allows a malicious low-privilege website user to bypass account isolation controls, including CloudLinux CageFS, and gain root access on shared-hosting servers, enabling cross-tenant compromise of other accounts on the same server. LiteSpeed released version 6.3.7 on September 11, but as of September 15 it was not yet available on the stable auto-update channel, so admins are urged to force the update manually (via lsup.sh -f -v 6.3.7). No CVE identifier, severity score, technical details, or workaround has been published, and it is unclear whether the flaw is being exploited. This is the third root-level LiteSpeed escape on cPanel servers since May, following CVE-2026-48172 and CVE-2026-54420 in the cPanel plugin, both of which were actively exploited and added to CISA's Known Exploited Vulnerabilities catalog. The open-source OpenLiteSpeed variant reportedly has no matching update.

  • Vulnerability affects LiteSpeed Web Server Enterprise versions before 6.3.7; fixed in 6.3.7, released September 11, 2026.
  • cPanel advisory published September 14, 2026; allows a low-privilege website user to bypass CageFS account isolation and gain root on shared-hosting servers, risking cross-tenant compromise.
  • No CVE identifier, severity score, technical details, or workaround published; exploitation status unknown.
  • 6.3.7 was not yet on the stable auto-update channel as of September 15; manual forced update recommended (lsup.sh -f -v 6.3.7).
  • Third LiteSpeed root-level flaw on cPanel servers since May 2026, following CVE-2026-48172 and CVE-2026-54420, both actively exploited and listed in CISA's KEV catalog.
  • The OpenLiteSpeed open-source variant has no matching update.

Coverage timeline

  1. · 15h ago
    The Hacker News· 58
    LiteSpeed Enterprise Flaw Could Let One Hosting Account Gain Root Access on a Shared Server

    cPanel warns critical LiteSpeed Web Server Enterprise flaw (pre-6.3.7) lets shared-hosting account users gain root access.

  2. · 9h ago
    Security Affairs· 52
    Shared Hosting at Risk: LiteSpeed Enterprise Bug Can Grant Root from a Single Tenant

    Critical LiteSpeed Web Server Enterprise flaw (pre-6.3.7) lets a low-privilege shared-hosting tenant escape CageFS isolation and gain root; forced update urged.

Vulnerabilities in this storyAll →

CVEVulnerabilityCVSSEPSSFlagsAffectedExposurePublished
CVE-2026-48172
Privilege Escalation (Possible Root) in LiteSpeed cPanel Plugin

CVE-2026-48172 is a critical privilege-escalation flaw (CWE-266, incorrect privilege assignment) in the LiteSpeed User-End cPanel plugin before 2.4.5, stemming from mishandling of the plugin's Redis enable/disable feature. It is exploitable over the network without authentication or user interaction (CVSS 4.0: AV:N/AC:L/PR:N/UI:N), and exploitation leaves traces of requests to the cPanel API's redisAble function in cPanel logs. An attacker who exploits it can elevate privileges to possibly root on the hosting server, meaning a single attacker could take control of every account and site hosted on that server. At risk are hosting providers and organizations running cPanel/WHM with the LiteSpeed cPanel plugin (and the related WHM plugin), a common premium web-server setup on multi-tenant shared-hosting platforms. The flaw was exploited in the wild in May 2026, was added to CISA's KEV catalog on 2026-05-26, and carries an EPSS of 18.9% (97th percentile); no public PoC is known.

Do: Upgrade the LiteSpeed User-End cPanel plugin to at least version 2.4.7 (versions before 2.4.5 are affected; 2.4.7 is the recommended minimum). Hunt for exploitation by running grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash: no output means you were not hit, while hits should be validated (confirm the listed IPs are legitimate, block any that are not, and review system logs for actions taken by those IPs). Because this is a CISA KEV entry (added 2026-05-26), apply the vendor fix per BOD 22-01 timelines or discontinue use of the product if mitigations are unavailable.

10.019% KEV
  • LiteSpeed Technologies (litespeedtech) LiteSpeed User-End cPanel Plugin before 2.4.5 (upgrade recommended to at least 2.4.7)
  • LiteSpeed Technologies (litespeedtech) LiteSpeed WHM Plugin listed in CPE data; no version range specified in source
largelikely tens of thousands of multi-tenant cPanel hosting servers (order of 10k-50k), with 100k+ tenant accounts behind them
CVE-2026-54420
Symlink-Following Privilege Escalation in LiteSpeed cPanel Plugin Exploited in the Wild

The LiteSpeed cPanel plugin, as distributed through the LiteSpeed WHM plugin, before version 2.4.8 (WHM plugin 5.3.2.0) mishandles UNIX symbolic links supplied by users (CWE-61). An attacker who already has FTP or web shell access to any account on a shared hosting server running CloudLinux/CageFS can plant a crafted symlink that the privileged plugin follows, letting them act beyond their own account scope — reportedly gaining root control of the entire server (CVSS scope change, C:H/I:H/A:H). Any hosting provider running vulnerable versions of the LiteSpeed cPanel/WHM plugin is affected, and because this is shared hosting, a single malicious tenant endangers other customers on the same server. The flaw was exploited in the wild in May 2026, was added to CISA's Known Exploited Vulnerabilities catalog on 2026-06-15 (BOD 26-04 remediation obligations apply), and has a 1.4% 30-day EPSS; no public proof-of-concept is known.

Do: Upgrade the LiteSpeed cPanel plugin to 2.4.8 or later via the LiteSpeed WHM plugin 5.3.2.0 or later, following vendor instructions to meet CISA KEV/BOD 26-04 timelines. Until patched, restrict or monitor FTP and web shell access on affected shared hosting servers and review logs for signs of privilege escalation during and since May 2026; if mitigations are unavailable, follow applicable BOD 26-04 guidance for cloud services or discontinue use.

8.51% KEV
  • LiteSpeed Technologies LiteSpeed cPanel plugin before 2.4.8
  • LiteSpeed Technologies LiteSpeed WHM plugin before 5.3.2.0 (ships the vulnerable cPanel plugin before 2.4.8)
largeest. tens of thousands of shared hosting servers (~10^4–10^5), each hosting many customer accounts