cyber.hendryadrian.com
Vulnerability & Exploit · bleepingcomputer.com

CISA Orders Federal Agencies to Patch Actively Exploited LiteSpeed cPanel Flaw

· Original article ↗

Summary

CISA ordered federal agencies to patch an actively exploited LiteSpeed cPanel plugin flaw within three days. The article identifies it as CVE-2026-48172 but also inconsistently references CVE-2026-54420.

Key points

  • The LiteSpeed cPanel user-end plugin flaw affects versions before 2.4.8 and stems from a UNIX symlink-following weakness.
  • Attackers with FTP or web shell access can escalate privileges to root on shared hosting servers running CloudLinux/CageFS.
  • CISA added CVE-2026-48172 to its Known Exploited Vulnerabilities Catalog and gave federal civilian agencies three days to secure affected systems under BOD 26-04.
  • LiteSpeed released security updates and said the flaw was actively exploited; it advised checking server logs for possible exploitation and investigating any detected IPs.
  • The article’s opening identifies the flaw as CVE-2026-54420, while the rest of the article identifies it as CVE-2026-48172.

Article Details

Vulnerability Types
  • UNIX symlink following weakness
Severity
High
Affected Versions
  • LiteSpeed cPanel user-end plugin versions before 2.4.8
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Discontinue use of the product if mitigations are unavailable.

MITRE ATT&CK

T1068 · Exploitation for Privilege EscalationAttackers with FTP or web shell access can exploit the flaw to escalate privileges to root on affected shared hosting servers.

CVE

CVE-2026-48172Litespeedtech · Litespeed cpanel plugin; Litespeedtech · Litespeed whm pluginThe issue, tracked as CVE-2026-48172 and reported by Namecheap, can let attackers with FTP or web shell access escalate to root on shared hosting servers running CloudLinux/CageFS.

Vendors

LiteSpeedfederal agencies to patch an actively exploited LiteSpeed cPanel user-end plugin flaw within three days, after the vulnerability was added to the Known Exploited Vulnerabilities Catalog.

Products

CageFSThe issue, tracked as CVE-2026-48172 and reported by Namecheap, can let attackers with FTP or web shell access escalate to root on shared hosting servers running CloudLinux/CageFS.CloudLinuxThe issue, tracked as CVE-2026-48172 and reported by Namecheap, can let attackers with FTP or web shell access escalate to root on shared hosting servers running CloudLinux/CageFS.cPanel user-end pluginfederal agencies to patch an actively exploited LiteSpeed cPanel user-end plugin flaw within three days, after the vulnerability was added to the Known Exploited Vulnerabilities Catalog.WHM pluginLiteSpeed flagged it as actively exploited in early June and released urgent security updates, warning users to update the cPanel user-end plugin (bundled with the WHM plugin) to the latest version.

Countries

United StatesCISA has ordered U.S. federal agencies to patch an actively exploited LiteSpeed cPanel user-end plugin flaw within three days, after the vulnerability was added to the Known Exploited Vulnerabilities Catalog.

Related Articles